What is the CVSS score of CVE-2026-8011?

CVE-2026-8011 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-8011?

Yes, a patch is available for CVE-2026-8011. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-8011

EUVD-2026-28125 MEDIUM

Protection Mechanism Failure (CWE-693)

2026-05-06 Chrome

Information Disclosure Google

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network-delivered via crafted page (AV:N), no privileges needed (PR:N), mandatory user visit (UI:R), limited cross-origin data leak only (C:L, I:N, A:N, S:U).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

6.5 LOW

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 00:32 vuln.today

CVSS changed

May 06, 2026 - 22:22 NVD

4.3 (MEDIUM)

CVE Published

May 06, 2026 - 18:13 nvd

MEDIUM 4.3

DescriptionCVE.org

Insufficient policy enforcement in Search in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Cross-origin data leakage in Google Chrome's Search feature prior to version 148.0.7778.96 allows a remote unauthenticated attacker to read data from a different origin by luring a user to a crafted HTML page. The flaw stems from insufficient policy enforcement in the Search component (CWE-693), bypassing intended cross-origin isolation protections. No public exploit code has been identified and CISA has not added this to the KEV catalog; with an EPSS of 0.03%, real-world exploitation probability is very low at time of analysis.

Technical ContextAI

CWE-693 (Protection Mechanism Failure) identifies a gap in enforcing a security policy that is otherwise expected to constrain behavior - in this case Chrome's same-origin policy or an analogous search-scoped isolation mechanism. The Search feature in Chrome can initiate or reflect queries that interact with page content; insufficient policy enforcement means that a specially crafted HTML page can trigger a code path that inadvertently exposes data belonging to a cross-origin context. The affected product is Google Chrome across all platforms, identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, for all versions prior to 148.0.7778.96. Tags reference Red Hat and SUSE downstream packaging, indicating the vulnerability is present in Linux distribution-packaged Chromium builds as well.

RemediationAI

Upgrade Google Chrome to version 148.0.7778.96 or later; this is the vendor-released patch confirmed by the Chrome Stable Channel update advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html. Chrome's auto-update mechanism will deploy this for most users automatically. Red Hat and SUSE users should apply distribution-provided Chromium package updates when available through their respective channels. No workarounds are documented; given the low severity and user-interaction requirement, disabling or restricting access to the Chrome Search feature (where technically feasible via enterprise policy) could reduce exposure in sensitive environments until the patch is applied, though this would degrade search usability.