What is the CVSS score of EUVD-2026-34472?

EUVD-2026-34472 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2026-34472?

Yes, a patch is available for EUVD-2026-34472. Update the affected software to the latest version immediately.

Google Chrome EUVD-2026-34472

| CVE-2026-11023 MEDIUM

Improper Input Validation (CWE-20)

2026-06-04 chrome-cve-admin@google.com

GHSA-49rg-f6g3-crgf

Authentication Bypass Google

6.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Red Hat

7.9 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 15:40 vuln.today

CVSS changed

Jun 08, 2026 - 15:37 NVD

6.5 (MEDIUM)

CVE Published

Jun 04, 2026 - 23:17 nvd

MEDIUM 6.5

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in WebAppInstalls in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Same-origin policy bypass in Google Chrome's WebAppInstalls component allows a remote attacker who has already compromised the renderer process to circumvent cross-origin protections via a crafted HTML page, yielding high integrity impact with no confidentiality or availability loss. All Chrome versions prior to 149.0.7827.53 are affected. No public exploit code has been identified and EPSS places this at the 6th percentile (0.02%), indicating very low observed exploitation probability; this is not listed in CISA KEV.

Technical ContextAI

The vulnerable component is WebAppInstalls, Chrome's subsystem responsible for handling Progressive Web App (PWA) installation flows. CWE-20 (Improper Input Validation) indicates the root cause is insufficient validation of inputs or state within this component, allowing an already-compromised renderer to pass maliciously crafted data that the browser process incorrectly trusts. The same-origin policy (SOP) is a foundational browser security boundary that prevents content from one origin from reading or manipulating resources of another; bypassing it can allow unauthorized writes or modifications across origins. The CVSS vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N reflects a network-delivered attack requiring user interaction (e.g., visiting a crafted page), with high integrity impact but no scope change, meaning the damage is contained to the compromised context rather than propagating to other security domains.

RemediationAI

Update Google Chrome to version 149.0.7827.53 or later, which contains the vendor-released patch for this vulnerability per the stable channel advisory at chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Chrome auto-update should handle this for most end users; enterprise administrators should verify managed deployments are on 149.0.7827.53+ via policy. As a compensating control where immediate patching is not possible, disabling or restricting PWA installation features via enterprise policy (Chrome's 'WebAppInstallForceList' and related policies) may reduce the attack surface of the WebAppInstalls component, though this would prevent legitimate PWA functionality. Additionally, since exploitation requires a prior renderer compromise, ensuring Chrome's site isolation (--site-per-process) is enforced and keeping the browser sandbox intact are meaningful layered defenses. No workaround fully substitutes for the patch.