CVE-2026-11195

chromium-browser: Inappropriate implementation in MHTML

Published Jun 4, 2026 CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Description

Inappropriate implementation in MHTML in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

Analysis

Technical impact

Google Chrome improperly processes MHTML content, enabling a remote attacker that convinces a user to perform certain UI gestures to leak data from a different origin. The flaw results in information disclosure rather than code execution. The effect is the unauthorized read of cross‑origin data exposed through a crafted HTML page. The weakness aligns with improper handling of data across origins.

Affected Systems

Google Chrome versions prior to 149.0.7827.53 are affected. The vulnerability exists in the MHTML implementation and applies to the standard desktop releases of Chrome.

Risk and Exploitability

The CVSS score is 6.5 and the EPSS score is < 1%, indicating limited or unknown exploitation prevalence. The issue is not listed in the CISA KEV catalog. The attack requires a user to interact with a malicious page and perform specific UI gestures to trigger the leak, suggesting a moderate difficulty channel. While the Chromium severity is medium, the potential for cross‑origin data exposure represents a tangible confidentiality risk for affected users.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Google

Chrome

affected

Version	Status	Constraints
`149.0.7827.53`	affected	< 149.0.7827.53

Configuration 1 [-]

AND

cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*

OR	cpe:2.3:o:apple:macos:-:::::::*
	cpe:2.3:o:linux:linux_kernel:-:::::::*
	cpe:2.3:o:microsoft:windows:-:::::::*

No data.

Vendor Product Versions

Google

Chrome

Version	Status	Scheme	Platform
`[149.0.7827.53,149.0.7827.53)`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Google Chrome to version 149.0.7827.53 or later.
Disable MHTML import or handling via Chrome policies if an update is not immediately possible.
Educate users to avoid interacting with suspicious web pages that could trigger UI gestures to exploit the flaw.

Generated by OpenCVE AI on June 7, 2026 at 15:56 UTC.

Tracking

Advisories

Source	ID	Title
Debian DSA	DSA-6325-1	chromium security update

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.190% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html
https://issues.chromium.org/issues/503865896
https://nvd.nist.gov/vuln/detail/CVE-2026-11195
https://www.cve.org/CVERecord?id=CVE-2026-11195

History

Jun 10, 2026 12:45 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Apple Apple macos Linux Linux linux Kernel Microsoft Microsoft windows
CPEs		cpe:2.3:a:google:chrome:::::::: cpe:2.3:o:apple:macos:-:::::::* cpe:2.3:o:linux:linux_kernel:-:::::::* cpe:2.3:o:microsoft:windows:-:::::::*
Vendors & Products		Apple Apple macos Linux Linux linux Kernel Microsoft Microsoft windows

Jun 7, 2026 12:15 PM Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Title		chromium-browser: Inappropriate implementation in MHTML
Weaknesses		CWE-1021
References		https://nvd.nist.gov/vuln/detail/CVE-2026-11195 https://www.cve.org/CVERecord?id=CVE-2026-11195
Metrics	threat_severity `None`	threat_severity `Moderate`

Jun 5, 2026 6:15 PM Title updated. Weaknesses updated View changes

Type	Values Removed	Values Added
Title	Cross‑Origin Data Leakage via Improper MHTML Handling in Google Chrome
Weaknesses	CWE-200

Jun 5, 2026 4:30 PM Weaknesses updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-346 CWE-352
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jun 5, 2026 6:15 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Google Google chrome
Vendors & Products		Google Google chrome

Jun 5, 2026 4:00 AM Title updated. Weaknesses updated View changes

Type	Values Removed	Values Added
Title		Cross‑Origin Data Leakage via Improper MHTML Handling in Google Chrome
Weaknesses		CWE-200

Jun 4, 2026 11:15 PM Description updated. Added references View changes

Type	Values Removed	Values Added
Description		Inappropriate implementation in MHTML in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
References		https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html https://issues.chromium.org/issues/503865896