CVE-2026-11145

MediumCVSS 5.3/10Last modified Jul 23, 2026

Description

Race in Geolocation in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-362

Affected software

Vendor	Product	Versions
Google	Chrome	>= 149.0.7827.53, < 149.0.7827.53

References

https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.htmlVendor Advisory
https://issues.chromium.org/issues/501683745Permissions Required

Timeline

Published: Jun 4, 2026
Last modified: Jul 23, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-1114505.9Wheels through 4.1.1 derives its default production error-email address from the Host header of the request that starts the application. If CVE-2026-1114517.8Wheels CLI 4.0.0 through 4.1.1 insufficiently validates or escapes caller-supplied values and package contents. Deploy release/version/rollb CVE-2026-1114526.5Apache Airflow's secrets masker matched sensitive key names only in their snake_case form, so values stored under camelCase keys such as `pr CVE-2026-1114534.3Apache Airflow's API endpoint for deleting an asset's queued events checked Dag edit permission against the `dag_id` query parameter, but de CVE-2026-1114546.5Apache Airflow's asset API endpoints returned the IDs of Dags that are scheduled on, produce, or consume an asset without checking whether t CVE-2026-1114556.5Apache Airflow's asynchronous connection test checked permissions when the test was queued — only create permission when the connection ID d CVE-2026-1114567.1A missing authorization check has been found in ConsumerResource.setupOwner() function of consumer registration module in the Candlepin pack CVE-2026-1114586.8The fanx_fingerprint function in ssl/sslxprint.c of ssldump allocates a heap buffer for formatting FAN/1 X.509 certificate fingerprints. The CVE-2026-1114597.6An improper certificate validation vulnerability exists in Moxa Remote Connect Suite (MRC Client). Under certain conditions, an unauthentica CVE-2026-111469.6Insufficient validation of untrusted input in Chromoting in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromis CVE-2026-1114607.7A hard-coded cryptographic key vulnerability exists in the OnCell G3150A-LTE Series. Under certain conditions, an unauthenticated remote att CVE-2026-1114617.5An OS command injection vulnerability exists in OnCell G3150A-LTE Series. When the SMS management functionality is enabled and configured, a