CVE-2026-11084

chromium-browser: Inappropriate implementation in Password Manager

Published Jun 4, 2026 CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Description

Inappropriate implementation in Password Manager in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

Analysis

Technical impact

Inappropriate implementation in Google Chrome’s Password Manager prior to version 149.0.7827.53 enables a remote attacker to leak cross‑origin data via a crafted HTML page. The flaw allows the attacker to read data that was previously inaccessible between origins, potentially exposing sensitive information stored locally by the browser.

Affected Systems

Google Chrome builds before 149.0.7827.53 on all platforms are affected; users running any earlier stable channel version remain susceptible until the issue is addressed.

Risk and Exploitability

Chromium’s security team rated the vulnerability as medium severity with a CVSS score of 6.5 and an EPSS score of < 1%. The flaw can be exploited remotely by serving a malicious web page to a user’s browser, causing the leak of cross‑origin data. The vulnerability is not listed in CISA’s KEV catalog and no public exploits have been reported, yet its remote nature and the potential for data exposure justify prompt action.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Google

Chrome

affected

Version	Status	Constraints
`149.0.7827.53`	affected	< 149.0.7827.53

Configuration 1 [-]

AND

cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*

OR	cpe:2.3:o:apple:macos:-:::::::*
	cpe:2.3:o:linux:linux_kernel:-:::::::*
	cpe:2.3:o:microsoft:windows:-:::::::*

No data.

Vendor Product Versions

Google

Chrome

Version	Status	Scheme	Platform
`[149.0.7827.53,149.0.7827.53)`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Chrome to version 149.0.7827.53 or later, which includes a fix that addresses the password‑manager information‑exposure flaw.
Configure the browser’s privacy settings to enforce strict same‑origin policies and disable cross‑site data sharing, mitigating the missing access control weakness (CWE‑346).
Remove or disable any extensions that request extensive credentials or data‑access permissions, reducing the risk of CSRF‑like privilege escalation (CWE‑352).
Consider temporarily disabling the Password Manager feature or restricting its use until the official update is available, limiting potential data leakage.

Generated by OpenCVE AI on June 5, 2026 at 21:47 UTC.

Tracking

Advisories

Source	ID	Title
Debian DSA	DSA-6325-1	chromium security update

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.176% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html
https://issues.chromium.org/issues/500124500
https://nvd.nist.gov/vuln/detail/CVE-2026-11084
https://www.cve.org/CVERecord?id=CVE-2026-11084

History

Jun 8, 2026 2:45 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Apple Apple macos Linux Linux linux Kernel Microsoft Microsoft windows
CPEs		cpe:2.3:a:google:chrome:::::::: cpe:2.3:o:apple:macos:-:::::::* cpe:2.3:o:linux:linux_kernel:-:::::::* cpe:2.3:o:microsoft:windows:-:::::::*
Vendors & Products		Apple Apple macos Linux Linux linux Kernel Microsoft Microsoft windows

Jun 7, 2026 12:15 PM Title updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Title	Chrome Password Manager Cross‑Origin Data Leakage Vulnerability	chromium-browser: Inappropriate implementation in Password Manager
References		https://nvd.nist.gov/vuln/detail/CVE-2026-11084 https://www.cve.org/CVERecord?id=CVE-2026-11084
Metrics	threat_severity `None`	threat_severity `Moderate`

Jun 5, 2026 10:15 PM Title updated View changes

Type	Values Removed	Values Added
Title		Chrome Password Manager Cross‑Origin Data Leakage Vulnerability

Jun 5, 2026 8:15 PM Title updated. Weaknesses updated View changes

Type	Values Removed	Values Added
Title	Cross‑Origin Data Leak via Chrome Password Manager
Weaknesses	CWE-200

Jun 5, 2026 5:30 PM Weaknesses updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-346 CWE-352
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jun 5, 2026 4:30 AM Title updated. Weaknesses updated View changes

Type	Values Removed	Values Added
Title		Cross‑Origin Data Leak via Chrome Password Manager
Weaknesses		CWE-200

Jun 5, 2026 3:45 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Google Google chrome
Vendors & Products		Google Google chrome

Jun 4, 2026 11:15 PM Description updated. Added references View changes

Type	Values Removed	Values Added
Description		Inappropriate implementation in Password Manager in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
References		https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html https://issues.chromium.org/issues/500124500