CVE-2026-11034

chromium-browser: Insufficient validation of untrusted input in Tab Group Sync

View on CVE.org
Published Jun 4, 2026 CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Description
Insufficient validation of untrusted input in Tab Group Sync in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via malicious network traffic. (Chromium security severity: Medium)

Analysis

AI-generated

Technical impact

Insufficient validation of untrusted input in the Tab Group sync feature of Google Chrome for Android allows a remote attacker to inject arbitrary scripts or HTML content (UXSS). This flaw is identified as a medium‑severity vulnerability by Chromium and corresponds to the input‑validation error CWE‑20 and the displayed‑content error CWE‑79.

Affected Systems

All Chrome for Android installations that support Tab Group sync and are running versions older than 149.0.7827.53 are vulnerable. Devices with sync enabled and no patch applied are affected.

Risk and Exploitability

The CVSS score of 6.1 indicates moderate severity, and the EPSS score of <1% suggests a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to craft malicious sync traffic; the flaw is remotely exploitable over network traffic and does not require additional user interaction. The likely attack vector is the sync traffic between the device and sync servers, inferred from the description that malicious network traffic is used to inject payloads.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Chrome to version 149.0.7827.53 or newer
  • Disable Tab Group sync until the update is installed
  • Enable Safe Browsing and site‑filtering protections to reduce the impact of injected scripts

Generated by OpenCVE AI on June 7, 2026 at 15:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DSA Debian DSA DSA-6325-1 chromium security update
History
Type Values Removed Values Added
First Time appeared Google android
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
cpe:2.3:o:google:android:-:*:*:*:*:*:*:*
Vendors & Products Google android
Type Values Removed Values Added
Title chromium-browser: Insufficient validation of untrusted input in Tab Group Sync
Weaknesses CWE-79
References
Metrics threat_severity

None

 threat_severity

Moderate
Type Values Removed Values Added
Title Insufficient Input Validation in Chrome Tab Group Sync Enables Remote Script Injection (UXSS)
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome
Type Values Removed Values Added
Title Insufficient Input Validation in Chrome Tab Group Sync Enables Remote Script Injection (UXSS)
Type Values Removed Values Added
Description Insufficient validation of untrusted input in Tab Group Sync in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via malicious network traffic. (Chromium security severity: Medium)
Weaknesses CWE-20
References
Earlier changes (2)
Weaknesses
  • CWE-20

    Improper Input Validation

  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Sources

Status
PUBLISHED
Assigner
Chrome
Published
Updated
Jun 5, 2026, 7:14 PM
Reserved
Jun 4, 2026, 5:06 PM

View source JSON

Updated
Jun 5, 2026, 7:13 PM

JSON

Status
Analyzed
Published
Jun 4, 2026, 11:17 PM
Modified
Jul 23, 2026, 6:10 AM

View source JSON

Severity
Moderate
Public date
Jun 2, 2026, 12:00 AM

View source Bugzilla JSON

Updated
Jun 7, 2026, 3:30 PM

JSON