Description
Insufficient validation of untrusted input in Wallet in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
Published: 2026-06-04
Score: 4.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Insufficient validation of untrusted input in Google Chrome Wallet prior to version 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. The weakness is a form of CWE‑20 "Improper Input Validation" and CWE‑79 "Cross‑Site Scripting" and could make users interact with fraudulent wallet interfaces, potentially exposing sensitive data or enabling transaction manipulation.

Affected Systems

Google Chrome desktop versions earlier than 149.0.7827.53 are affected.

Risk and Exploitability

The vulnerability has a CVSS score of 4.3, rated low by Chromium’s security team, and is not listed in the CISA KEV catalog. The EPSS score is < 1%, indicating a very low probability of exploitation, especially since it requires prior compromise of the renderer process. Nonetheless, the potential for user deception exists, and updating Chrome mitigates the risk.

Generated by OpenCVE AI on June 7, 2026 at 15:35 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Google Chrome to version 149.0.7827.53 or later to fix the input validation flaw in the Wallet module.
  • If an upgrade cannot be applied immediately, disable the Wallet feature or remove the relevant extension to eliminate the vulnerable code path.
  • Apply Chrome’s Site Isolation and Safe Browsing protections and monitor user interfaces for unexpected UI elements until a patch is available.

Generated by OpenCVE AI on June 7, 2026 at 15:35 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-6325-1 chromium security update
History

Tue, 09 Jun 2026 15:45:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple macos
Linux
Linux linux Kernel
Microsoft
Microsoft windows
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
Vendors & Products Apple
Apple macos
Linux
Linux linux Kernel
Microsoft
Microsoft windows

Sun, 07 Jun 2026 12:15:00 +0000

Type Values Removed Values Added
Title chromium-browser: Insufficient validation of untrusted input in Wallet
Weaknesses CWE-79
References
Metrics threat_severity

None

 threat_severity

Low

Fri, 05 Jun 2026 22:30:00 +0000

Type Values Removed Values Added
Title Potential UI Spoofing via Untrusted Input in Google Chrome Wallet

Fri, 05 Jun 2026 20:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-451
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 05 Jun 2026 03:15:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Fri, 05 Jun 2026 01:00:00 +0000

Type Values Removed Values Added
Title Potential UI Spoofing via Untrusted Input in Google Chrome Wallet

Thu, 04 Jun 2026 23:45:00 +0000

Type Values Removed Values Added
Description Insufficient validation of untrusted input in Wallet in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
Weaknesses CWE-20
References

Subscriptions

Apple Macos
Google Chrome
Linux Linux Kernel
Microsoft Windows
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-06-05T19:12:38.968Z

Reserved: 2026-06-04T17:11:15.848Z

Link: CVE-2026-11286

cve-icon Vulnrichment

Updated: 2026-06-05T19:12:29.579Z

cve-icon NVD

Status : Analyzed

Published: 2026-06-05T00:17:06.057

Modified: 2026-06-09T15:42:26.000

Link: CVE-2026-11286

cve-icon Redhat

Severity : Low

Publid Date: 2026-06-02T00:00:00Z

Links: CVE-2026-11286 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-06-07T15:45:03Z

Weaknesses
  • CWE-20

    Improper Input Validation

  • CWE-451

    User Interface (UI) Misrepresentation of Critical Information

  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')