What is the CVSS score of CVE-2026-11686?

CVE-2026-11686 has a CVSS 3.1 base score of 3.1 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-11686?

Yes, a patch is available for CVE-2026-11686. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-11686

EUVD-2026-35212 LOW

Improper Input Validation (CWE-20)

2026-06-09 chrome-cve-admin@google.com

GHSA-mfw4-fc92-pwx6

Apple Information Disclosure Google

3.1

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

3.1 LOW

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Primary rating from Vendor (google) · only source for this CVE.

CVSS VectorVendor: google

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 02:57 vuln.today

CVSS changed

Jun 09, 2026 - 02:22 NVD

3.1 (LOW)

CVE Published

Jun 09, 2026 - 00:16 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient validation of untrusted input in Dawn in Google Chrome on macOS prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Cross-origin data leak in Chrome's Dawn (WebGPU) component on macOS affects all versions prior to 149.0.7827.103, allowing a remote attacker who has already compromised the renderer process to exfiltrate cross-origin data via a crafted HTML page. CVSS score of 3.1 (Low) accurately reflects the constrained impact: confidentiality loss only (C:L), no integrity or availability impact, and a hard prerequisite of prior renderer compromise that makes standalone exploitation impossible. No public exploit code exists and CISA SSVC assessment confirms exploitation status as none with non-automatable attack conditions.

Technical ContextAI

Dawn is Google Chrome's implementation of the WebGPU API, providing browser-based access to GPU hardware for graphics and compute workloads. The affected component processes input from web content through a graphics pipeline that, on macOS, exhibits platform-specific behavior differences in memory or GPU resource handling. CWE-20 (Improper Input Validation) identifies the root cause as insufficient sanitization of untrusted input flowing through Dawn before it crosses the site isolation boundary. This flaw allows data from one origin to be observed by an attacker-controlled context in the renderer - a violation of the Same-Origin Policy enforced by Chrome's site isolation architecture. The macOS-specific scope suggests the flaw is tied to Apple platform GPU APIs (Metal) or macOS-specific Dawn code paths rather than a cross-platform Dawn defect. No CPE string was provided in the source intelligence.

RemediationAI

Update Google Chrome on macOS to version 149.0.7827.103 or later using the vendor-released patch documented in the stable channel update advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html. This is the primary and confirmed fix; the exact patch version is vendor-confirmed. Given that exploitation requires a pre-compromised renderer, organizations should treat this as part of routine patch management rather than an out-of-band emergency response. No workarounds are described in the available advisories. As a compensating control, enforcing strict site isolation policies (--site-per-process, which is Chrome's default) and ensuring no co-existing renderer vulnerabilities are unpatched effectively neutralizes this issue in practice, since renderer compromise is the hard prerequisite. Restricting access to untrusted web content on macOS endpoints (e.g., via enterprise browser policies or URL filtering) reduces exposure but does not eliminate the underlying flaw.