CVE-2026-11181

MediumCVSS 6.3/10Last modified Jul 23, 2026

Description

Inappropriate implementation in Media Session in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-346

Affected software

No affected versions have been published.

Timeline

Published
Jun 4, 2026
Last modified
Jul 23, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-1118107.5Apache Traffic Server 9.2.15, 10.1.4 and 10.2.0 write one unthrottled diagnostic log line for every internal @ header they strip, so a requeCVE-2026-1118119.0Apache Traffic Server's experimental tsmemcache plugin allows unauthenticated network read, write, and deletion of the shared proxy cache. CVE-2026-11181210.0Apache Traffic Server's origin_server_auth plugin lets a client force signing of attacker-chosen AWS request headers under the proxy's own cCVE-2026-11181310.0Apache Traffic Server's experimental magick plugin lets an unauthenticated client control ImageMagick convert arguments in its default (unsiCVE-2026-11181410.0Apache Traffic Server's default outbound session-sharing policy can reuse a pooled TLS session authenticated with one client certificate forCVE-2026-11181510.0Apache Traffic Server can resume a TLS session across SNI virtual hosts without re-verifying a client certificate required by the resumed hoCVE-2026-1118169.3Apache Traffic Server forwarded a malformed 302 response that should have been rejected as a parse error, because the Transfer-Encoding: chuCVE-2026-1118175.3Apache Traffic Server can stall a chunked transfer that it passes through with its trailers removed (proxy.config.http.drop_chunked_trailersCVE-2026-111826.5Inappropriate implementation in SVG in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafteCVE-2026-1118207.2The Analytics Insights – Google Analytics Dashboard for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the CVE-2026-1118217.5Improper input validation vulnerability in Apache ActiveMQ, Apache ActiveMQ KahaDB. A user can create a durable subscription with a clienCVE-2026-1118228.1Improper invalidation of cached authorizations vulnerability in Apache ActiveMQ, Apache ActiveMQ Runtime Config. After the runtime config
CVE-2026-11181: Medium severity, CVSS 6.3 | Vulnix