CVE-2026-11273

chromium-browser: Insufficient validation of untrusted input in Omnibox

View on CVE.org
Published Jun 4, 2026 CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Description
Insufficient validation of untrusted input in Omnibox in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Low)

Analysis

AI-generated

Technical impact

Google Chrome versions before 149.0.7827.53 contain insufficient validation of untrusted input in the omnibox, allowing a remote attacker who convinces a user to perform specific UI gestures to inject arbitrary scripts or HTML (UXSS). This flaw is classified as CWE‑20 (Improper Input Validation) and CWE‑79 (Cross‑Site Scripting), enabling execution of injected scripts in the browser context, potentially compromising user data, credentials, or other browser state.

Affected Systems

All desktop releases of Google Chrome on all operating systems for which the build number is less than 149.0.7827.53 are affected. Users running older stable releases without this update remain vulnerable.

Risk and Exploitability

The vulnerability is scored by Chromium with a CVSS vector of 6.1; EPSS is <1%, indicating a low but nonzero threat that an adversary could exploit. The attack requires a victim to first open a crafted HTML page and then perform specific UI gestures; therefore, successful exploitation relies on user interaction. The exploitability is limited by the requirement for user action and the need for the browser version to be older than 149.0.7827.53. The flaw is not listed in CISA’s KEV catalog.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Google Chrome to version 149.0.7827.53 or newer using the browser’s built‑in updater or the operating system’s update mechanism.
  • Disable omnibox suggestions by navigating to chrome://settings/omnibox and turning off "Show search suggestions as you type," which removes the vulnerable input path before the patch is applied.
  • In environments where the patch cannot be applied immediately, disable the omnibox entirely via enterprise policy by setting OmniboxEnabled to false to eliminate the vulnerable input path until the update is available.

Generated by OpenCVE AI on June 5, 2026 at 23:05 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DSA Debian DSA DSA-6325-1 chromium security update
History
Type Values Removed Values Added
First Time appeared Apple
Apple macos
Linux
Linux linux Kernel
Microsoft
Microsoft windows
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
Vendors & Products Apple
Apple macos
Linux
Linux linux Kernel
Microsoft
Microsoft windows
Type Values Removed Values Added
Title chromium-browser: Insufficient validation of untrusted input in Omnibox
References
Metrics threat_severity

None

 threat_severity

Low
Type Values Removed Values Added
Title Untrusted Input Validation Failure in Chrome Omnibox Allows Arbitrary Script Injection
Type Values Removed Values Added
Weaknesses CWE-79
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Title Untrusted Input Validation Failure in Chrome Omnibox Allows Arbitrary Script Injection
Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome
Type Values Removed Values Added
Description Insufficient validation of untrusted input in Omnibox in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Low)
Weaknesses CWE-20
References
Earlier changes (2)
Weaknesses
  • CWE-20

    Improper Input Validation

  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Sources

Status
PUBLISHED
Assigner
Chrome
Published
Updated
Jun 5, 2026, 7:32 PM
Reserved
Jun 4, 2026, 5:11 PM

View source JSON

Updated
Jun 5, 2026, 7:32 PM

JSON

Status
Analyzed
Published
Jun 5, 2026, 12:17 AM
Modified
Jul 23, 2026, 7:10 AM

View source JSON

Severity
Low
Public date
Jun 2, 2026, 12:00 AM

View source Bugzilla JSON

Updated
Jun 5, 2026, 11:15 PM

JSON