What is the CVSS score of CVE-2026-11693?

CVE-2026-11693 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-11693?

Google Chrome versions prior to 149.0.7827.103 contain a site isolation bypass that allows attackers with prior renderer process compromise to escape cross-origin boundaries, potentially exposing…. A patch is available.

How to fix or mitigate CVE-2026-11693?

Within 24 hours: Audit Chrome version distribution across endpoints and prepare deployment communications. Within 7 days: Roll out Google Chrome 149.0.7827.103 or later organization-wide; prioritize systems with network access to sensitive data. Within 30 days: Confirm 100% coverage through endpoint management systems and remove unsupported versions from active use.

Google Chrome CVE-2026-11693

EUVD-2026-35219 HIGH

Origin Validation Error (CWE-346)

2026-06-09 chrome-cve-admin@google.com

GHSA-r6r7-44pc-4g42

Authentication Bypass Google

8.1

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

SUSE

CRITICAL

qualitative

Red Hat

8.7 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 14:24 vuln.today

CVSS changed

Jun 09, 2026 - 14:22 NVD

8.1 (HIGH)

CVE Published

Jun 09, 2026 - 00:16 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 09, 2026 - 00:16 nvd

HIGH 8.1

DescriptionCVE.org

Inappropriate implementation in Plugins in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Site isolation bypass in Google Chrome versions prior to 149.0.7827.103 allows a remote attacker who has already compromised the renderer process to escape cross-origin boundaries via a crafted HTML page. The flaw is rated High severity by Chromium and carries a CVSS score of 8.1, though EPSS is very low at 0.02% and no public exploit identified at time of analysis. This is a second-stage vulnerability requiring prior renderer compromise, typically chained with a separate RCE in the renderer sandbox.

Technical ContextAI

Site isolation is a core Chromium security architecture that places content from different origins into separate OS-level processes so that a compromise of one renderer cannot read or manipulate data belonging to another site. This issue resides in Chrome's Plugins component and is classified as CWE-346 (Origin Validation Error), meaning the Plugins implementation failed to correctly enforce or verify the origin boundary that site isolation depends on. As an Origin Validation Error, the bug undermines the guarantee that a renderer process is confined to acting on behalf of its own origin, letting a malicious renderer reach data or capabilities belonging to another site.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.103 (desktop stable channel) - update Chrome via the built-in updater and restart the browser to apply, per the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html. Enterprises managing Chrome via Group Policy or MDM should push the updated MSI/PKG and verify the version in chrome://settings/help across the fleet. As an interim compensating control until updates roll out, restrict or block browser plugin usage via the DefaultPluginsSetting and PluginsAllowedForUrls enterprise policies - this reduces the attack surface in the Plugins code path with the trade-off of breaking sites that depend on plugin APIs. Users of Chromium-based browsers (Edge, Brave, Opera, Vivaldi) should monitor those vendors for the corresponding uplifted release and update accordingly.