Skip to content
OpenAdvisories
Low · 3.1 CVE-2026-11684 EUVD-2026-35210GHSA-m67c-5qcr-q2mm

Insufficient policy enforcement in Network in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the utili…

Published Jun 8, 2026 · Updated Jun 9, 2026 · Assigned by Chrome

Description

Insufficient policy enforcement in Network in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the utility process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

Affected products

VendorProductAffectedFixed
Google Chrome 149.0.7827.103 – < 149.0.7827.103 149.0.7827.103

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 chromium 149.0.7827.102-1 —
Debian 13 chromium 149.0.7827.102-1~deb13u1 —
Debian 12 chromium 149.0.7827.102-1~deb12u1 —
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed chromium 149.0.7827.102-1.1 openSUSE-SU-2026:11008-1
openSUSE Leap 16.0 chromium 149.0.7827.155-bp160.1.1 openSUSE-SU-2026:21135-1

Advisories 3

References