CVE-2026-11666

MediumCVSS 5.4/10Last modified Jul 23, 2026

Description

Insufficient validation of untrusted input in Input in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: High)

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
Google	Chrome	>= 149.0.7827.103, < 149.0.7827.103

References

https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.htmlRelease Notes, Vendor Advisory
https://issues.chromium.org/issues/514009323Permissions Required

Timeline

Published: Jun 9, 2026
Last modified: Jul 23, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-1166604.3Tanium addressed an improper access controls vulnerability in Enforce.CVE-2026-1166616.5Tanium addressed an improper access controls vulnerability in Enforce.CVE-2026-1166627.5Tanium addressed a compression bomb vulnerability in Enforce.CVE-2026-1166636.5Tanium addressed an improper access controls vulnerability in Enforce.CVE-2026-1166643.1Tanium addressed an improper access controls vulnerability in Discover.CVE-2026-1166654.3Tanium addressed an information disclosure vulnerability in Discover.CVE-2026-1166664.3Tanium addressed an information disclosure vulnerability in Discover.CVE-2026-1166674.2Tanium addressed an improper access controls vulnerability in Discover.CVE-2026-1166684.3Tanium addressed an uncontrolled resource consumption vulnerability in Discover.CVE-2026-1166696.5Tanium addressed an improper access controls vulnerability in Discover.CVE-2026-116677.5Out of bounds read in WebRTC in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the GPU process to poten CVE-2026-1166712.1Infinite loop in Xpdf 4.06 and earlier, due to incorrect validation of progression order field in JPEG 2000 image.