Description
Insufficient validation of untrusted input in Omnibox in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Low)
Published: 2026-06-04
Score: 6.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Google Chrome versions before 149.0.7827.53 contain insufficient validation of untrusted input in the omnibox, allowing a remote attacker who convinces a user to perform specific UI gestures to inject arbitrary scripts or HTML (UXSS). This flaw is classified as CWE‑20 (Improper Input Validation) and CWE‑79 (Cross‑Site Scripting), enabling execution of injected scripts in the browser context, potentially compromising user data, credentials, or other browser state.

Affected Systems

All desktop releases of Google Chrome on all operating systems for which the build number is less than 149.0.7827.53 are affected. Users running older stable releases without this update remain vulnerable.

Risk and Exploitability

The vulnerability is scored by Chromium with a CVSS vector of 6.1; EPSS is <1%, indicating a low but nonzero threat that an adversary could exploit. The attack requires a victim to first open a crafted HTML page and then perform specific UI gestures; therefore, successful exploitation relies on user interaction. The exploitability is limited by the requirement for user action and the need for the browser version to be older than 149.0.7827.53. The flaw is not listed in CISA’s KEV catalog.

Generated by OpenCVE AI on June 5, 2026 at 23:05 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update Google Chrome to version 149.0.7827.53 or newer using the browser’s built‑in updater or the operating system’s update mechanism.
  • Disable omnibox suggestions by navigating to chrome://settings/omnibox and turning off "Show search suggestions as you type," which removes the vulnerable input path before the patch is applied.
  • In environments where the patch cannot be applied immediately, disable the omnibox entirely via enterprise policy by setting OmniboxEnabled to false to eliminate the vulnerable input path until the update is available.

Generated by OpenCVE AI on June 5, 2026 at 23:05 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-6325-1 chromium security update
History

Mon, 08 Jun 2026 14:30:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple macos
Linux
Linux linux Kernel
Microsoft
Microsoft windows
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
Vendors & Products Apple
Apple macos
Linux
Linux linux Kernel
Microsoft
Microsoft windows

Sun, 07 Jun 2026 12:15:00 +0000

Type Values Removed Values Added
Title chromium-browser: Insufficient validation of untrusted input in Omnibox
References
Metrics threat_severity

None

 threat_severity

Low

Fri, 05 Jun 2026 23:15:00 +0000

Type Values Removed Values Added
Title Untrusted Input Validation Failure in Chrome Omnibox Allows Arbitrary Script Injection

Fri, 05 Jun 2026 20:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-79
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 05 Jun 2026 01:15:00 +0000

Type Values Removed Values Added
Title Untrusted Input Validation Failure in Chrome Omnibox Allows Arbitrary Script Injection

Fri, 05 Jun 2026 01:00:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Thu, 04 Jun 2026 23:45:00 +0000

Type Values Removed Values Added
Description Insufficient validation of untrusted input in Omnibox in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Low)
Weaknesses CWE-20
References

Subscriptions

Apple Macos
Google Chrome
Linux Linux Kernel
Microsoft Windows
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-06-05T19:32:33.177Z

Reserved: 2026-06-04T17:11:11.683Z

Link: CVE-2026-11273

cve-icon Vulnrichment

Updated: 2026-06-05T19:32:24.511Z

cve-icon NVD

Status : Analyzed

Published: 2026-06-05T00:17:04.387

Modified: 2026-06-08T14:17:42.397

Link: CVE-2026-11273

cve-icon Redhat

Severity : Low

Publid Date: 2026-06-02T00:00:00Z

Links: CVE-2026-11273 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-06-05T23:15:08Z

Weaknesses
  • CWE-20

    Improper Input Validation

  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')