Description
Inappropriate implementation in File System Access in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to bypass discretionary access control via a crafted HTML page. (Chromium security severity: Low)
Published: 2026-06-04
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

In Google Chrome versions prior to 149.0.7827.53 an inappropriate implementation of File System Access handling allows a remote attacker who lures a user into performing specific UI gestures on a crafted web page to bypass discretionary access controls, effectively obtaining elevated file system permissions beyond those normally granted to the user. The flaw is associated with CWE-284 and CWE-551.

Affected Systems

The vulnerability affects any platform where an unpatched Google Chrome installation is running. Users of Chrome before updating to 149.0.7827.53 are at risk; no other vendors or products are directly impacted.

Risk and Exploitability

The attacker must first persuade the victim to interact with the malicious page, so the attack vector is user-dependent and somewhat limited in scale. The EPSS score is below 1% and the CVSS score of 6.5 indicates moderate severity. The flaw is not currently listed in CISA’s KEV catalog. Nonetheless, because it can lead to privilege escalation, it warrants prompt patching by all affected users.

Generated by OpenCVE AI on June 7, 2026 at 16:25 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Chrome update 149.0.7827.53 or later to address the file system access flaw identified as CWE-284 and CWE-551.
  • Disable File System Access permissions for untrusted sites, reducing the risk of arbitrary access (CWE-284).
  • Enable automatic updates to ensure similar access control defects are promptly patched in the future.

Generated by OpenCVE AI on June 7, 2026 at 16:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-6325-1 chromium security update
History

Mon, 08 Jun 2026 14:30:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple macos
Linux
Linux linux Kernel
Microsoft
Microsoft windows
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
Vendors & Products Apple
Apple macos
Linux
Linux linux Kernel
Microsoft
Microsoft windows

Sun, 07 Jun 2026 12:15:00 +0000

Type Values Removed Values Added
Title Chrome File System Access Discretionary Control Bypass via UI Gestures chromium-browser: Inappropriate implementation in File System Access
Weaknesses CWE-551
References
Metrics threat_severity

None

 threat_severity

Low

Sat, 06 Jun 2026 00:30:00 +0000

Type Values Removed Values Added
Title Chrome File System Access Discretionary Control Bypass via UI Gestures

Fri, 05 Jun 2026 23:15:00 +0000

Type Values Removed Values Added
Title Chrome File System Access Bypass via Crafted Page
Weaknesses CWE-285

Fri, 05 Jun 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 05 Jun 2026 03:30:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Fri, 05 Jun 2026 01:15:00 +0000

Type Values Removed Values Added
Title Chrome File System Access Bypass via Crafted Page
Weaknesses CWE-284
CWE-285

Thu, 04 Jun 2026 23:45:00 +0000

Type Values Removed Values Added
Description Inappropriate implementation in File System Access in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to bypass discretionary access control via a crafted HTML page. (Chromium security severity: Low)
References

Subscriptions

Apple Macos
Google Chrome
Linux Linux Kernel
Microsoft Windows
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-06-05T19:55:35.207Z

Reserved: 2026-06-04T17:11:07.168Z

Link: CVE-2026-11258

cve-icon Vulnrichment

Updated: 2026-06-05T19:55:24.306Z

cve-icon NVD

Status : Analyzed

Published: 2026-06-05T00:17:02.470

Modified: 2026-06-08T14:19:38.873

Link: CVE-2026-11258

cve-icon Redhat

Severity : Low

Publid Date: 2026-06-02T00:00:00Z

Links: CVE-2026-11258 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-06-07T16:30:04Z

Weaknesses
  • CWE-284

    Improper Access Control

  • CWE-551

    Incorrect Behavior Order: Authorization Before Parsing and Canonicalization