CVE-2026-11008

MediumCVSS 6.5/10Last modified Jul 22, 2026

Description

Insufficient validation of untrusted input in WebAppInstalls in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published
Jun 4, 2026
Last modified
Jul 22, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-1100805.4Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipuCVE-2026-1100815.4Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker CVE-2026-1100825.4Adobe Experience Manager is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convinCVE-2026-1100837.1Adobe Experience Manager is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerabilitCVE-2026-1100847.1Adobe Experience Manager is affected by an XML Injection (aka Blind XPath Injection) vulnerability that could result in a Security feature bCVE-2026-1100857.8Premiere Pro is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the currentCVE-2026-1100867.8Premiere Pro is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the currentCVE-2026-1100876.7Premiere Pro is affected by a Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current userCVE-2026-1100887.8Premiere Pro is affected by a Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current userCVE-2026-1100897.8Premiere Pro is affected by a Buffer Underwrite ('Buffer Underflow') vulnerability that could result in arbitrary code execution in the contCVE-2026-110099.6Use after free in USB in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape vCVE-2026-1100907.1Premiere Pro is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead
CVE-2026-11008: Medium severity, CVSS 6.5 | Vulnix