What is the CVSS score of EUVD-2026-34715?

EUVD-2026-34715 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2026-34715?

Yes, a patch is available for EUVD-2026-34715. Update the affected software to the latest version immediately.

Google Chrome EUVD-2026-34715

| CVE-2026-11254 MEDIUM

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-06-05 chrome-cve-admin@google.com

GHSA-q9xv-w349-hffr

Information Disclosure Google

4.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

SUSE

MEDIUM

qualitative

Red Hat

4.3 LOW

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 12:31 vuln.today

CVSS changed

Jun 05, 2026 - 12:22 NVD

4.3 (MEDIUM)

CVE Published

Jun 05, 2026 - 00:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 05, 2026 - 00:17 nvd

MEDIUM 4.3

DescriptionCVE.org

Inappropriate implementation in Permissions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

UI spoofing in Google Chrome's Permissions implementation prior to version 149.0.7827.53 allows a remote, unauthenticated attacker to deceive users through manipulated browser permission dialogs via a crafted HTML page. Exploitation requires user interaction - a victim must visit a malicious page - and the real-world impact is limited to low-integrity outcomes such as misleading users into granting or denying permissions under false pretenses. No public exploit code exists and this vulnerability has not been added to the CISA KEV catalog at time of analysis.

Technical ContextAI

CWE-451 (User Interface Misrepresentation of Critical Information) describes flaws where the UI presents misleading or inaccurate information to the user, undermining trust decisions. In Chrome's Permissions subsystem, this implementation flaw allows a crafted HTML page to manipulate how permission prompts - such as those for geolocation, camera, microphone, or notifications - are rendered or contextualized, enabling an attacker to spoof the origin, context, or nature of a permission request. The affected codebase corresponds to Chromium's permissions UI layer, tracked in Chromium issue 498405554. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) confirms the flaw is remotely triggerable with no authentication and low complexity, but requires user interaction to reach the vulnerable code path.

RemediationAI

Update Google Chrome to version 149.0.7827.53 or later, which contains the vendor-released patch for this issue. The stable channel update is documented at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Chrome's automatic update mechanism should apply this patch without manual intervention for most users; administrators managing enterprise deployments should verify fleet-wide rollout via Google Admin Console or equivalent endpoint management tooling. No workarounds are identified for this issue given its location in the browser's core permissions UI; the only reliable mitigation is applying the patch. Given the low severity, emergency out-of-band deployment is not warranted, but inclusion in the next standard patch cycle is recommended.