What is the CVSS score of EUVD-2026-34686?

EUVD-2026-34686 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2026-34686?

Yes, a patch is available for EUVD-2026-34686. Update the affected software to the latest version immediately.

Google Chrome EUVD-2026-34686

| CVE-2026-11225 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-06-04 chrome-cve-admin@google.com

GHSA-wj5p-x655-p89c

Information Disclosure Google Red Hat Suse Chrome

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

SUSE

MEDIUM

qualitative

Red Hat

5.4 LOW

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 15:30 vuln.today

CVSS changed

Jun 05, 2026 - 15:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 04, 2026 - 23:17 nvd

MEDIUM 6.5

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in WebUI in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform domain spoofing via a crafted domain name. (Chromium security severity: Low)

AnalysisAI

Domain spoofing in Google Chrome's WebUI component (versions prior to 149.0.7827.53) allows unauthenticated remote attackers to display a misleading domain name in the browser UI by delivering a crafted domain to a victim. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) assigns High integrity impact, reflecting the ability to undermine a user's origin-trust decisions - the cornerstone of browser security. No public exploit code exists and EPSS sits at 0.03% (10th percentile), consistent with Google's own 'Low' Chromium severity rating; risk is realistic but non-urgent outside phishing-focused threat models.

Technical ContextAI

CWE-451 (User Interface Misrepresentation of Critical Information) identifies the root cause: Chrome's WebUI layer fails to correctly normalize or render certain crafted domain names, causing the address bar or UI chrome to display a domain that differs from the actual navigation target. This class of flaw typically involves internationalized domain name (IDN) homograph characters, Unicode bidirectional text overrides, or improper punycode handling - techniques that exploit gaps between how domain strings are stored and how they are visually presented to users. The affected component is the WebUI subsystem responsible for rendering security-sensitive origin information. No CPE string was included in the provided data, but the EUVD-confirmed affected product is desktop Chrome prior to version 149.0.7827.53 across all platforms.

RemediationAI

Update Google Chrome to version 149.0.7827.53 or later, which contains the vendor-released patch per the stable channel update advisory at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Chrome auto-updates by default on consumer systems; enterprise administrators using Chrome Browser Cloud Management or group policy should confirm managed devices have received the update. As a compensating control before patching, security teams can enforce proxy-based URL filtering to block known homograph or IDN-abusing domains, though this does not eliminate the underlying rendering flaw and introduces URL-inspection overhead. User awareness training to verify certificate details rather than relying solely on the address bar display is a low-friction supplementary control.