PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-11686 Google CVE debrief

CVE-2026-11686 is a vulnerability in Google Chrome on macOS, specifically in the Dawn component. The issue is caused by insufficient validation of untrusted input, which could allow a remote attacker who has compromised the renderer process to leak cross-origin data via a crafted HTML page. This vulnerability has been rated as High severity by Chromium and has a CVSS score of 3.1, which is considered Low severity.

Vendor
Google
Product
Chrome
CVSS
LOW 3.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-09
Original CVE updated
2026-06-09
Advisory published
2026-06-09
Advisory updated
2026-06-09

Who should care

Users of Google Chrome on macOS, particularly those who may be targeted by remote attackers, should be aware of this vulnerability. Additionally, administrators and security teams responsible for managing Chrome deployments should prioritize patching to prevent exploitation.

Technical summary

The vulnerability exists in the Dawn component of Google Chrome on macOS. Dawn is a part of the Chromium project, which is the open-source foundation for Google Chrome. The issue arises from insufficient validation of untrusted input, which can be exploited by a remote attacker who has compromised the renderer process. This can lead to the leakage of cross-origin data via a specially crafted HTML page.

Defensive priority

High

Recommended defensive actions

  • Update Google Chrome to version 149.0.7827.103 or later to patch the vulnerability.
  • Ensure that Chrome is configured to automatically update to the latest version.
  • Users and administrators should be cautious when visiting untrusted websites or clicking on links from unknown sources to reduce the risk of exploitation.

Evidence notes

The CVE-2026-11686 vulnerability was published on June 9, 2026, and modified on the same day. The vulnerability affects Google Chrome on macOS versions prior to 149.0.7827.103. The CVSS vector for this vulnerability is CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-11686 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-11686

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-11686 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-11686

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.