What is the CVSS score of EUVD-2026-34587?

EUVD-2026-34587 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2026-34587?

Yes, a patch is available for EUVD-2026-34587. Update the affected software to the latest version immediately.

Google Chrome EUVD-2026-34587

| CVE-2026-11126 MEDIUM

Improper Input Validation (CWE-20)

2026-06-04 chrome-cve-admin@google.com

GHSA-2367-xw5p-w8h5

Information Disclosure Google Chrome Red Hat Suse

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Red Hat

5.9 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 17:31 vuln.today

CVSS changed

Jun 08, 2026 - 17:22 NVD

4.3 (MEDIUM)

CVE Published

Jun 04, 2026 - 23:17 nvd

MEDIUM 4.3

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in DevTools in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension to leak cross-origin data via a crafted Chrome Extension. (Chromium security severity: Medium)

AnalysisAI

Cross-origin data leakage in Google Chrome DevTools affects all versions prior to 149.0.7827.53, exploitable through a crafted malicious Chrome Extension. The inappropriate DevTools implementation allows an attacker who successfully social-engineers a victim into installing the extension to read data from cross-origin contexts - violating the browser's same-origin isolation guarantees at the DevTools layer. No public exploit code exists and no CISA KEV listing is present; EPSS at 0.02% (4th percentile) confirms low exploitation probability in the wild, making this a routine patch-cycle priority rather than an emergency response item.

Technical ContextAI

The root cause is classified as CWE-20 (Improper Input Validation), meaning the DevTools component fails to adequately validate or enforce boundaries when processing data or API calls originating from Chrome Extension contexts. Chrome DevTools exposes privileged inspection APIs - DOM traversal, network request inspection, JavaScript execution contexts - that are normally isolated from standard web content. An 'inappropriate implementation' in this layer means a crafted extension can invoke or manipulate DevTools behavior in a way that bypasses cross-origin restrictions, allowing data from otherwise-isolated origins to be read. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) places the attack vector as network-reachable with low complexity once the extension is installed, but scope remains unchanged (S:U), indicating the confidentiality leak is constrained within the browser's own security boundary rather than escaping to the underlying OS. No CPE string was provided in source data; the affected product is identifiable as Google Chrome desktop versions below 149.0.7827.53 across all supported platforms.

RemediationAI

Update Google Chrome to version 149.0.7827.53 or later - this is the vendor-confirmed fix documented in the stable channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Enterprise administrators managing Chrome via Google Admin or third-party MDM should deploy this update through standard browser management tooling. For environments where immediate patching is not possible, the most targeted compensating control is restricting Chrome Extension installation via the ExtensionInstallBlocklist or ExtensionAllowedTypes enterprise policies, which prevents untrusted extensions from reaching the vulnerable code path entirely - note this will require a policy infrastructure and may block legitimate user extensions, requiring an allowlist of approved extensions to preserve workflows. A more aggressive control is enabling the DeveloperToolsDisabled enterprise policy, which removes the DevTools attack surface entirely at the cost of blocking all developer tooling for affected users. Both controls should be treated as temporary mitigations pending patch deployment, as they introduce operational trade-offs.