What is the CVSS score of EUVD-2026-35227?

EUVD-2026-35227 has a contested CVSS base score of 5.4 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for EUVD-2026-35227?

Yes, a patch is available for EUVD-2026-35227. Update the affected software to the latest version immediately.

Google Chrome EUVD-2026-35227

| CVE-2026-11701 MEDIUM

Improper Input Validation (CWE-20)

2026-06-09 chrome-cve-admin@google.com

GHSA-7c3h-9xjm-v983

Information Disclosure Google

Medium

Disputed · 5.4 Vendor: google

Severity by source

Sources disagree (Medium–Critical)

Vendor (google) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L

SUSE

CRITICAL

qualitative

Red Hat

4.3 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: google

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 14:26 vuln.today

CVSS changed

Jun 09, 2026 - 14:22 NVD

5.4 (MEDIUM)

CVE Published

Jun 09, 2026 - 00:16 nvd

MEDIUM 5.4

CVE Published

Jun 09, 2026 - 00:16 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in Guest View in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

UI spoofing in Google Chrome's Guest View component prior to 149.0.7827.103 enables a remote unauthenticated attacker to deceive users about page content or origin by delivering a crafted HTML page. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms exploitation requires no privileges and no special network position, but does require the victim to visit a malicious page. With an EPSS score of 0.05% at the 15th percentile and no CISA KEV listing, real-world exploitation is currently assessed as low probability, though the zero-friction delivery mechanism (a link) keeps the attack surface broad.

Technical ContextAI

Guest View is Chrome's internal framework for embedding isolated guest web content, primarily surfaced through the <webview> tag in Chrome Apps and Extensions. CWE-20 (Improper Input Validation) as the root cause indicates that inputs processed by the Guest View subsystem are not adequately validated or sanitized, allowing crafted HTML content to manipulate Chrome's rendered UI in unexpected ways. This class of bug typically allows an attacker to overlay or substitute UI elements - such as browser chrome, security indicators, or origin information - making malicious content appear trustworthy. The CVSS vector S:U (Unchanged scope) confirms the exploit is contained within the browser process rather than escaping to the underlying OS.

RemediationAI

Update Google Chrome to version 149.0.7827.103 or later, which contains the vendor-released patch for this issue. The official Stable Channel Update advisory is available at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html. Chrome's auto-update mechanism should apply this update automatically on most desktop installations; administrators managing enterprise fleets should verify deployment via Chrome Browser Cloud Management or equivalent policy tooling. No specific workaround is documented for this vulnerability. As a compensating control while updates are applied, organizations can restrict access to untrusted external URLs through web proxy filtering or DNS-based controls, which would reduce exposure by preventing users from reaching attacker-controlled pages - though this is impractical for general-purpose browsing environments and does not eliminate the vulnerability.