CVE-2026-11133

MediumCVSS 6.5/10Last modified Jul 23, 2026

Description

Insufficient policy enforcement in Paint in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-346

Affected software

Vendor	Product	Versions
Google	Chrome	>= 149.0.7827.53, < 149.0.7827.53

References

https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.htmlVendor Advisory
https://issues.chromium.org/issues/501606085Permissions Required

Timeline

Published: Jun 4, 2026
Last modified: Jul 23, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-1113305.9JuggleIM im-server through 1.8.16 contains a weak password hashing vulnerability that stores admin console passwords as unsalted SHA-1 diges CVE-2026-1113316.3Dokploy through 0.30.8 contains a cross-organization authorization bypass in the port tRPC router that allows authenticated owners or admins CVE-2026-1113323.7OxiCloud 0.9.1 through 0.9.3 contains an incorrect authorization vulnerability that allows anonymous visitors to keep share access after pas CVE-2026-1113336.9Memory overflow in an authentication request can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC an CVE-2026-1113349.3Memory overflow in Endpoint Analysis (EPA/EPAS) can lead to unpredictable or erroneous behavior or a Denial of Service in Citrix NetScaler A CVE-2026-1113356.9Improper request handling can lead to a denial-of-service / reboot-loop condition in Citrix NetScaler ADC and Citrix NetScaler Gateway.CVE-2026-1113368.3Memory overflow in HTTP/2 handling can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix N CVE-2026-1113378.7Memory overflow in Base64 decoding in advanced policy expressions leading to unpredictable or erroneous behavior or Denial of Service in Cit CVE-2026-1113386.9Sensitive authentication material written to a log file in Citrix NetScaler ADC and Citrix NetScaler Gateway.CVE-2026-1113396.9Memory overflow in Application Firewall data decompression/inspection can lead to unpredictable or erroneous behavior or Denial of Service i CVE-2026-111346.5Inappropriate implementation in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a craf CVE-2026-1113408.7Memory overflow in KBA (knowledge-based authentication) can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetSc