What is the CVSS score of EUVD-2026-35215?

EUVD-2026-35215 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2026-35215?

Yes, a patch is available for EUVD-2026-35215. Update the affected software to the latest version immediately.

Google Chrome EUVD-2026-35215

| CVE-2026-11689 HIGH

Improper Input Validation (CWE-20)

2026-06-09 chrome-cve-admin@google.com

GHSA-wx4m-978h-jhx3

Google Authentication Bypass

8.1

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

SUSE

CRITICAL

qualitative

Red Hat

8.7 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

CVE Published

Jun 22, 2026 - 06:03 cve.org

HIGH 8.1

Analysis Generated

Jun 09, 2026 - 14:23 vuln.today

CVSS changed

Jun 09, 2026 - 14:22 NVD

8.1 (HIGH)

CVE Published

Jun 09, 2026 - 00:16 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient policy enforcement in Passwords in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Site isolation bypass in Google Chrome's Passwords component prior to version 149.0.7827.103 allows a remote attacker who has already compromised the renderer process to escape cross-origin boundaries via a crafted HTML page. The flaw is rated High severity by Chromium with a CVSS 8.1 score, but EPSS exploitation probability is very low (0.02%, 6th percentile) and no public exploit identified at time of analysis. The vendor has shipped a fix in the stable channel.

Technical ContextAI

The vulnerability sits in Chrome's Passwords subsystem and stems from insufficient policy enforcement (CWE-20, Improper Input Validation) around site isolation - the browser security boundary that ensures content from one origin cannot read or interact with another origin's process memory or stored credentials. Site isolation is implemented in Chromium by assigning each site to its own renderer process and validating cross-process IPC messages against the originating site's policy; weak validation of password-related IPC or policy checks lets a malicious renderer make requests it should not be authorized to make. The affected component is the Chromium browser engine itself (vendor:product cpe pattern google:chrome), and the issue was reported through the internal Chromium security process (chrome-cve-admin@google.com, tracker issue 517486004).

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.103 (stable desktop) - upgrade immediately via Chrome's built-in updater (chrome://settings/help) or enterprise deployment tooling, and restart the browser to apply the fix as documented in the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html. For managed fleets, push the update through Group Policy, Jamf, Intune, or equivalent and verify the version on endpoints; Chromium-downstream browsers should be updated as soon as their respective vendors ship the corresponding rebase. As a compensating control until patching completes, restrict browsing of untrusted sites (URL allowlisting via enterprise policy), keep the Chrome sandbox enabled (do not launch with --no-sandbox), and consider disabling password autofill / sync via the PasswordManagerEnabled enterprise policy on high-value endpoints - the trade-off is loss of user convenience and reduced phishing resistance from autofill.