CVE-2026-11157

chromium-browser: Script injection in Accessibility

Published Jun 4, 2026 CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Description

Script injection in Accessibility in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension to inject arbitrary scripts or HTML (UXSS) via a crafted Chrome Extension. (Chromium security severity: Medium)

Analysis

Technical impact

This vulnerability allows an attacker who has convinced a user to install a malicious Chrome extension to inject arbitrary scripts or HTML into the browser through the Accessibility interface. The flaw, identified as a code injection weakness (CWE‑94), permits the injected content to be placed into the browser’s user interface.

Affected Systems

All users of Google Chrome versions before 149.0.7827.53 are impacted. The issue appears in the desktop Chrome stable channel and affects the Accessibility feature exposed to extensions. Any installation of a malicious or compromised extension that exploits this path is sufficient to trigger the flaw.

Risk and Exploitability

The exploit requires a malicious or untrusted extension to be installed; it is not a network‑remote attack vector. The EPSS score of <1% indicates a very low exploitation probability, and it is not listed in the CISA KEV catalog. The CVSS score of 5.4, indicating a Medium severity, suggests that once the malicious extension is installed, the injected scripts or HTML could be executed within the user’s browser context.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Google

Chrome

affected

Version	Status	Constraints
`149.0.7827.53`	affected	< 149.0.7827.53

Configuration 1 [-]

AND

cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*

OR	cpe:2.3:o:apple:macos:-:::::::*
	cpe:2.3:o:linux:linux_kernel:-:::::::*
	cpe:2.3:o:microsoft:windows:-:::::::*

No data.

Vendor Product Versions

Google

Chrome

Version	Status	Scheme	Platform
`[149.0.7827.53,149.0.7827.53)`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update Chrome to version 149.0.7827.53 or newer.
Avoid installing extensions from untrusted or unknown developers.
Uninstall or disable any installed extensions that request accessibility permissions or exhibit suspicious behavior.

Generated by OpenCVE AI on June 7, 2026 at 16:01 UTC.

Tracking

Advisories

Source	ID	Title
Debian DSA	DSA-6325-1	chromium security update

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.121% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html
https://issues.chromium.org/issues/501823385
https://nvd.nist.gov/vuln/detail/CVE-2026-11157
https://www.cve.org/CVERecord?id=CVE-2026-11157

History

Jun 8, 2026 3:00 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Apple Apple macos Linux Linux linux Kernel Microsoft Microsoft windows
CPEs		cpe:2.3:a:google:chrome:::::::: cpe:2.3:o:apple:macos:-:::::::* cpe:2.3:o:linux:linux_kernel:-:::::::* cpe:2.3:o:microsoft:windows:-:::::::*
Vendors & Products		Apple Apple macos Linux Linux linux Kernel Microsoft Microsoft windows

Jun 7, 2026 12:15 PM Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Title		chromium-browser: Script injection in Accessibility
Weaknesses		CWE-79
References		https://nvd.nist.gov/vuln/detail/CVE-2026-11157 https://www.cve.org/CVERecord?id=CVE-2026-11157
Metrics	threat_severity `None`	threat_severity `Moderate`

Jun 5, 2026 8:15 PM Title updated View changes

Type	Values Removed	Values Added
Title	Script Injection via Malicious Chrome Extension

Jun 5, 2026 7:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jun 5, 2026 6:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N'}`

Jun 5, 2026 5:15 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Google Google chrome
Vendors & Products		Google Google chrome

Jun 5, 2026 4:15 AM Title updated View changes

Type	Values Removed	Values Added
Title		Script Injection via Malicious Chrome Extension

Jun 4, 2026 11:15 PM Description updated. Weaknesses updated. Added references View changes

Type	Values Removed	Values Added
Description		Script injection in Accessibility in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension to inject arbitrary scripts or HTML (UXSS) via a crafted Chrome Extension. (Chromium security severity: Medium)
Weaknesses		CWE-94
References		https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html https://issues.chromium.org/issues/501823385

Earlier changes (3)

Subscriptions

Apple Macos

Google Chrome

Linux Linux Kernel

Microsoft Windows

Weaknesses

CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-94
Improper Control of Generation of Code ('Code Injection')