What is the CVSS score of EUVD-2026-34603?

EUVD-2026-34603 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2026-34603?

Yes, a patch is available for EUVD-2026-34603. Update the affected software to the latest version immediately.

Google Chrome EUVD-2026-34603

| CVE-2026-11142 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-06-04 chrome-cve-admin@google.com

GHSA-g3jm-h647-x2wg

Authentication Bypass Google Chrome

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Red Hat

8.1 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 06, 2026 - 05:32 vuln.today

CVSS changed

Jun 06, 2026 - 05:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 04, 2026 - 23:17 nvd

MEDIUM 6.5

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient policy enforcement in Paint in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Same-origin policy bypass in Google Chrome's Paint component prior to version 149.0.7827.53 allows a remote, unauthenticated attacker to violate cross-origin integrity protections by inducing a user to visit a crafted HTML page. The flaw stems from insufficient policy enforcement in the Paint subsystem (CWE-639), enabling an attacker to write or manipulate content across origin boundaries, resulting in high integrity impact with no confidentiality or availability loss per the CVSS vector. No public exploit code has been identified at time of analysis, and the EPSS score of 0.02% (4th percentile) indicates very low current exploitation probability.

Technical ContextAI

The affected component is Chrome's Paint subsystem, part of the Blink rendering engine responsible for compositing and drawing web content. CWE-639 (Authorization Bypass Through User-Controlled Key) indicates that an attacker-controlled value - likely a resource identifier or origin token used during paint operations - can be manipulated to circumvent same-origin policy (SOP) enforcement. SOP is the foundational browser security boundary separating content from distinct origins; a bypass allows cross-origin DOM writes or resource access without explicit CORS permission. The affected version range covers all Chrome releases prior to 149.0.7827.53 on desktop platforms, per the ENISA EUVD entry EUVD-2026-34603 and the affected CPE range 'Chrome 149.0.7827.53 < 149.0.7827.53'.

RemediationAI

Vendor-released patch: Chrome 149.0.7827.53. Users and administrators should update Google Chrome to version 149.0.7827.53 or later via Chrome's built-in update mechanism (chrome://settings/help) or through enterprise deployment tooling such as Google Update or OS-level package managers. The fix is documented in the stable channel release advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. For environments where immediate patching is not feasible, administrators can reduce exposure by enforcing browser management policies that restrict navigation to untrusted external sites, deploying URL filtering to block known malicious domains, and enabling Chrome's Enhanced Safe Browsing mode - though these are compensating controls, not remediation, and carry the trade-off of reduced browsing freedom or reliance on Google's threat intelligence feed. No workaround that fully mitigates the Paint SOP bypass without patching has been identified from available data.