CVE-2026-11225

MediumCVSS 6.5/10Last modified Jul 23, 2026

Description

Inappropriate implementation in WebUI in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform domain spoofing via a crafted domain name. (Chromium security severity: Low)

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-451

Affected software

Vendor	Product	Versions
Google	Chrome	>= 149.0.7827.53, < 149.0.7827.53

References

https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.htmlVendor Advisory
https://issues.chromium.org/issues/503346647Permissions Required

Timeline

Published: Jun 4, 2026
Last modified: Jul 23, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-1122504.4A vulnerability has been identified in BRAIN2 versions up to and including version 3.09. Under specific installation conditions, the passwor CVE-2026-1122514.3A vulnerability was detected in antoinersx clawhost up to 0.0.45. This affects the function handleRequest of the file apps/clawhostgo/src/ma CVE-2026-1122527.3A vulnerability has been found in Wuxi Wubang Security Software Wubang Five-in-One Safety Production Management Information System up to 3.5 CVE-2026-1122544.3A vulnerability was found in agit8or1 clientst0r up to 3.17.586. Affected by this vulnerability is the function _fetch_html of the file loca CVE-2026-1122552.9Initialization of a resource with an insecure default vulnerability in OpenText Advanced Authentication Server allows Excessive Allocation. CVE-2026-1122569.2Acceptance of extraneous untrusted data with trusted data vulnerability in OpenText Advanced Authentication Server allows Accessing Function CVE-2026-1122577.8A flaw was found in GIMP. The PSD thumbnail resource loader performs a BGR-to-RGB channel swap with a fixed 3-byte stride and does not verif CVE-2026-1122587.8A flaw was found in GIMP. The XCF loader can leave a dangling pointer in the linked-channels list when a linked channel is later destroyed v CVE-2026-1122595.5A flaw was found in GIMP. Importing a crafted SBZ palette without a color-model attribute can cause a NULL pointer dereference during string CVE-2026-112266.5Insufficient policy enforcement in PreviewTab in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who convinced a u CVE-2026-1122607.1A flaw was found in GIMP. Opening a crafted XCF with a malformed text-layer parasite can cause a heap out-of-bounds read, disclosing adjacen CVE-2026-1122617.8A flaw was found in GIMP. Opening a crafted XCF that selects a path and then fails to load that path can cause a use-after-free in the main