PT-2026-46577 · Google · Google Chrome

CVE-2026-11048 · Published 2026-06-02 · Updated 2026-06-08

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 149.0.7827.53

Description An inappropriate implementation in Extensions allows an attacker to bypass the same origin policy—a security mechanism that restricts how a document or script loaded from one origin can interact with a resource from another origin—by convincing a user to install a crafted malicious extension.

Recommendations Update to version 149.0.7827.53 or later.

Fix

DoS

Origin Validation Error

Weakness Enumeration

CWE-346

Related Identifiers

CVE-2026-11048

ECHO-CA1B-B22B-F5DA

OPENSUSE-SU-2026:10958-1

Affected Products

Google Chrome

References · 439

• https://security-tracker.debian.org/tracker/CVE-2026-11048 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-11048 · Security Note
• https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10958-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-11048 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-11048 · Security Note
• https://suse.com/security/cve/CVE-2026-11084 · Note
• https://suse.com/security/cve/CVE-2026-11017 · Note
• https://suse.com/security/cve/CVE-2026-11200 · Note
• https://suse.com/security/cve/CVE-2026-10918 · Note
• https://suse.com/security/cve/CVE-2026-10894 · Note
• https://suse.com/security/cve/CVE-2026-10944 · Note
• https://suse.com/security/cve/CVE-2026-10923 · Note
• https://suse.com/security/cve/CVE-2026-11235 · Note
• https://suse.com/security/cve/CVE-2026-11107 · Note