Description
Inappropriate implementation in Browser in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)
Published: 2026-06-04
Score: 4.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An improper enforcement of navigation restrictions in Google Chrome versions prior to 149.0.7827.53 allows a remote attacker to bypass navigation controls by delivering a crafted HTML page. This vulnerability can enable the attacker to redirect users to unintended or malicious destinations.

Affected Systems

Google Chrome desktop browsers with build versions earlier than 149.0.7827.53 are affected. The issue applies to any installation that has not received the June 2026 stable channel update.

Risk and Exploitability

The vulnerability is rated with a CVSS score of 4.3, indicating low severity. The EPSS score is less than 1%, reflecting a very low likelihood of exploitation in the wild. It is not listed in the CISA KEV catalog. Based on the description, it can be inferred that the attacker would need to supply a crafted HTML page to a victim, though the exact attack vector is not detailed in the CVE entry.

Generated by OpenCVE AI on June 7, 2026 at 16:25 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Chrome to version 149.0.7827.53 or later via the official update channel
  • Ensure that automatic updates are enabled so that Chrome receives the latest security patches in a timely manner
  • If possible, enable Chrome’s strict navigation security features, such as Site Isolation or similar controls, to mitigate the risk of navigation bypass

Generated by OpenCVE AI on June 7, 2026 at 16:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-6325-1 chromium security update
History

Mon, 08 Jun 2026 14:30:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple macos
Linux
Linux linux Kernel
Microsoft
Microsoft windows
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
Vendors & Products Apple
Apple macos
Linux
Linux linux Kernel
Microsoft
Microsoft windows

Sun, 07 Jun 2026 12:15:00 +0000

Type Values Removed Values Added
Title Remote Navigation Restriction Bypass via Crafted HTML Page in Google Chrome chromium-browser: Inappropriate implementation in Browser
Weaknesses CWE-1220
References
Metrics threat_severity

None

 threat_severity

Low

Sat, 06 Jun 2026 00:15:00 +0000

Type Values Removed Values Added
Title Remote Navigation Restriction Bypass via Crafted HTML Page in Google Chrome

Fri, 05 Jun 2026 22:30:00 +0000

Type Values Removed Values Added
Title Bypass Navigation Restrictions via Crafted HTML Page in Google Chrome
Weaknesses CWE-285

Fri, 05 Jun 2026 20:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 05 Jun 2026 01:00:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Fri, 05 Jun 2026 00:45:00 +0000

Type Values Removed Values Added
Title Bypass Navigation Restrictions via Crafted HTML Page in Google Chrome
Weaknesses CWE-285

Thu, 04 Jun 2026 23:45:00 +0000

Type Values Removed Values Added
Description Inappropriate implementation in Browser in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)
References

Subscriptions

Apple Macos
Google Chrome
Linux Linux Kernel
Microsoft Windows
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-06-05T19:57:03.266Z

Reserved: 2026-06-04T17:11:06.867Z

Link: CVE-2026-11257

cve-icon Vulnrichment

Updated: 2026-06-05T19:56:55.282Z

cve-icon NVD

Status : Analyzed

Published: 2026-06-05T00:17:02.353

Modified: 2026-06-08T14:25:51.463

Link: CVE-2026-11257

cve-icon Redhat

Severity : Low

Publid Date: 2026-06-02T00:00:00Z

Links: CVE-2026-11257 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-06-07T16:30:04Z

Weaknesses
  • CWE-1220

    Insufficient Granularity of Access Control

  • CWE-284

    Improper Access Control