CVE-2026-11126

chromium-browser: Insufficient validation of untrusted input in DevTools

Published Jun 4, 2026 CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Description

Inappropriate implementation in DevTools in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension to leak cross-origin data via a crafted Chrome Extension. (Chromium security severity: Medium)

Analysis

Technical impact

An insufficient input validation in DevTools enabled an attacker to obtain cross‑origin data by persuading a user to install a malicious Chrome extension. The flaw allows the attacker to read data that should be protected by the same‑origin policy, compromising the confidentiality of the user’s information. The weakness matches CWE‑20, Improper Input Validation.

Affected Systems

The vulnerability affects Google Chrome for any build before 149.0.7827.53. Versions 149.0.7827.53 and later are not affected. Users of any older Chrome build that allow malicious extensions are vulnerable.

Risk and Exploitability

The CVE is rated medium severity with a CVSS score of 4.3 and an EPSS score of < 1%, and it is not listed in the CISA KEV catalog. Likely exploitation requires a user to install a malicious extension, so the attack vector is user‑initiated intent. While the vulnerability is not currently flagged as exploited, the inherent confidentiality risk warrants prompt remediation.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Google

Chrome

affected

Version	Status	Constraints
`149.0.7827.53`	affected	< 149.0.7827.53

Configuration 1 [-]

AND

cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*

OR	cpe:2.3:o:apple:macos:-:::::::*
	cpe:2.3:o:linux:linux_kernel:-:::::::*
	cpe:2.3:o:microsoft:windows:-:::::::*

No data.

Vendor Product Versions

Google

Chrome

Version	Status	Scheme	Platform
`[0,149.0.7827.53)`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Chrome to version 149.0.7827.53 or newer where the issue is fixed
Remove any installed Chrome extensions that may be malicious or from untrusted sources
Configure Chrome policies to restrict the installation of extensions unless explicitly approved

Generated by OpenCVE AI on June 8, 2026 at 17:50 UTC.

Tracking

Advisories

Source	ID	Title
Debian DSA	DSA-6325-1	chromium security update

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.154% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html
https://issues.chromium.org/issues/501528031
https://nvd.nist.gov/vuln/detail/CVE-2026-11126
https://www.cve.org/CVERecord?id=CVE-2026-11126

History

Jun 9, 2026 3:15 AM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Apple Apple macos Linux Linux linux Kernel Microsoft Microsoft windows
CPEs		cpe:2.3:a:google:chrome:::::::: cpe:2.3:o:apple:macos:-:::::::* cpe:2.3:o:linux:linux_kernel:-:::::::* cpe:2.3:o:microsoft:windows:-:::::::*
Vendors & Products		Apple Apple macos Linux Linux linux Kernel Microsoft Microsoft windows

Jun 8, 2026 4:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 5.9, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N'}`	ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}` cvssV3_1 `{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N'}`

Jun 7, 2026 12:15 PM Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Title	Chrome DevTools Cross-Origin Data Leakage via Malicious Extension	chromium-browser: Insufficient validation of untrusted input in DevTools
Weaknesses		CWE-940
References		https://nvd.nist.gov/vuln/detail/CVE-2026-11126 https://www.cve.org/CVERecord?id=CVE-2026-11126
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.9, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N'}` threat_severity `Moderate`

Jun 5, 2026 5:30 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Google Google chrome
Vendors & Products		Google Google chrome

Jun 5, 2026 4:30 AM Title updated View changes

Type	Values Removed	Values Added
Title		Chrome DevTools Cross-Origin Data Leakage via Malicious Extension

Jun 4, 2026 11:15 PM Description updated. Weaknesses updated. Added references View changes

Type	Values Removed	Values Added
Description		Inappropriate implementation in DevTools in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension to leak cross-origin data via a crafted Chrome Extension. (Chromium security severity: Medium)
Weaknesses		CWE-20
References		https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html https://issues.chromium.org/issues/501528031