What is the CVSS score of CVE-2026-11695?

CVE-2026-11695 has a contested CVSS base score of 4.3 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for CVE-2026-11695?

Yes, a patch is available for CVE-2026-11695. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-11695

EUVD-2026-35221 MEDIUM

Protection Mechanism Failure (CWE-693)

2026-06-09 chrome-cve-admin@google.com

GHSA-q4rm-h6xg-hcmq

Information Disclosure Google

Medium

Disputed · 4.3 Vendor: google

Severity by source

Sources disagree (Medium–Critical)

Vendor (google) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

SUSE

CRITICAL

qualitative

Red Hat

7.4 HIGH

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: google

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 02:56 vuln.today

CVSS changed

Jun 09, 2026 - 02:22 NVD

4.3 (MEDIUM)

CVE Published

Jun 09, 2026 - 00:16 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 09, 2026 - 00:16 nvd

MEDIUM 4.3

DescriptionCVE.org

Inappropriate implementation in Passwords in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Cross-origin data leakage in Google Chrome's Passwords feature (all versions prior to 149.0.7827.103) can be triggered by a remote unauthenticated attacker delivering a crafted HTML page to a victim. The flaw results from an inappropriate implementation classified under CWE-693 (Protection Mechanism Failure), meaning the browser's same-origin policy enforcement is bypassed specifically within the Passwords subsystem. With a CVSS score of 4.3 and no public exploit or CISA KEV listing identified at time of analysis, this is a medium-severity information disclosure risk requiring user interaction to exploit.

Technical ContextAI

The vulnerability resides in the Passwords component of the Chromium browser engine, which handles autofill, credential storage, and password-related UI behaviors. CWE-693 (Protection Mechanism Failure) indicates the root cause is a failure to correctly apply or enforce a security protection mechanism - in this context, the Same-Origin Policy (SOP), which is the browser's foundational isolation boundary between web origins. An 'inappropriate implementation' in the Passwords subsystem inadvertently exposes data that should be scoped to a single origin, making it readable by a cross-origin page. The affected CPE corresponds to Google Chrome prior to 149.0.7827.103 on desktop platforms, as confirmed by the EUVD advisory (EUVD-2026-35221) and Google's stable channel release notes.

RemediationAI

The primary fix is to update Google Chrome to version 149.0.7827.103 or later via the browser's built-in update mechanism (chrome://settings/help) or enterprise deployment tooling. The patch is confirmed available from the vendor per the stable channel advisory at chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html. No workaround fully addresses the root cause; however, organizations that cannot immediately deploy the patch may reduce exposure by disabling Chrome's built-in password manager (chrome://settings/passwords → turn off 'Offer to save passwords' and 'Auto sign-in') - note this removes autofill functionality and shifts credential management responsibility to users or a third-party manager. Browser isolation policies (e.g., enforcing Site Isolation via enterprise policy SitePerProcess) may reduce cross-origin data exposure as a defense-in-depth measure but are not a confirmed mitigation for this specific flaw.