Description
Inappropriate implementation in Link Preview in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)
Published: 2026-06-04
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

In Google Chrome versions prior to 149.0.7827.53 the Link Preview component contains an inappropriate implementation that allows a remote attacker who has already compromised the renderer process to bypass navigation restrictions by delivering a specially crafted HTML page. The flaw reflects improper target validation and access control weaknesses described by CWE-1021, CWE-284, enabling the renderer to follow URLs that should otherwise be blocked.

Affected Systems

All users running Google Chrome desktop before version 149.0.7827.53 are affected. No other Google products or third‑party applications are impacted by this issue.

Risk and Exploitability

Chromium assigns this defect a CVSS score of 6.5, placing it in the medium severity range. The EPSS score is below 1%, indicating a low likelihood of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the attacker first to compromise the renderer process, after which a crafted HTML page can be served from any site the user visits to force navigation beyond the intended restrictions.

Generated by OpenCVE AI on June 8, 2026 at 16:41 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Google Chrome to version 149.0.7827.53 or later, which contains the fix for the Link Preview logic.
  • If an immediate update is not practical, add Chrome’s security flags or policies that disable the Link Preview feature, removing the vulnerable code path.
  • Maintain Chrome’s sandbox and renderer isolation settings to reduce the risk that a renderer process is compromised in the first place.

Generated by OpenCVE AI on June 8, 2026 at 16:41 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-6325-1 chromium security update
History

Mon, 08 Jun 2026 18:30:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple macos
Linux
Linux linux Kernel
Microsoft
Microsoft windows
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
Vendors & Products Apple
Apple macos
Linux
Linux linux Kernel
Microsoft
Microsoft windows

Mon, 08 Jun 2026 15:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N'}

 ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N'}

Sun, 07 Jun 2026 15:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-1184
CWE-284

Sun, 07 Jun 2026 12:15:00 +0000

Type Values Removed Values Added
Title Link Preview Navigation Restriction Bypass in Chrome chromium-browser: Inappropriate implementation in Link Preview
Weaknesses CWE-1021
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N'}

threat_severity

Moderate

Fri, 05 Jun 2026 07:30:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Fri, 05 Jun 2026 03:15:00 +0000

Type Values Removed Values Added
Title Link Preview Navigation Restriction Bypass in Chrome
Weaknesses CWE-1184
CWE-284

Thu, 04 Jun 2026 23:15:00 +0000

Type Values Removed Values Added
Description Inappropriate implementation in Link Preview in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)
References

Subscriptions

Apple Macos
Google Chrome
Linux Linux Kernel
Microsoft Windows
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-06-08T14:53:33.287Z

Reserved: 2026-06-04T17:06:30.215Z

Link: CVE-2026-11017

cve-icon Vulnrichment

Updated: 2026-06-08T14:52:37.986Z

cve-icon NVD

Status : Analyzed

Published: 2026-06-04T23:17:05.640

Modified: 2026-06-08T18:17:40.373

Link: CVE-2026-11017

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-06-02T00:00:00Z

Links: CVE-2026-11017 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-06-08T16:45:26Z

Weaknesses
  • CWE-1021

    Improper Restriction of Rendered UI Layers or Frames

  • CWE-284

    Improper Access Control