CVE-2026-11684
Chromium: CVE-2026-11684 Insufficient policy enforcement in Network
CVE-2026-11684 is fixed in 9 products on 3 platforms, first by Google Chrome Dev (EXE) 150.0.7828.2, released May 6, 2026. It is not reported as exploited. Patch Radar priority: Routine.
RoutineFixed on 3 platforms
CVSS
3.1
low
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0017
5th percentile
<p>This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see <a href="https://chromereleases.googleblog.com/2025">Google Chrome Releases</a> for more information.</p>
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Windows apps | |||
| Google Chrome (EXE) | 149.0.7827.103 | Google Chrome (EXE) 149.0.7827.103 | Jun 6, 2026 |
| Google Chrome Beta (EXE) | 150.0.7871.4 | Google Chrome Beta (EXE) 150.0.7871.4 | Jun 3, 2026 |
| Google Chrome Dev (EXE) | 150.0.7828.2 | Google Chrome Dev (EXE) 150.0.7828.2 | May 6, 2026 |
| Microsoft Edge | 149.0.4022.62 | Microsoft Edge 149.0.4022.62 | Jun 9, 2026 |
| Microsoft Edge Beta | 151.0.4129.59 | Microsoft Edge Beta 151.0.4129.59 | Jul 31, 2026 |
| Microsoft Edge Dev | 152.0.4167.0 | Microsoft Edge Dev 152.0.4167.0 | Jul 20, 2026 |
| Microsoft Edge WebView2 Runtime | 149.0.4022.62 | Microsoft Edge WebView2 Runtime 149.0.4022.62 | Jun 9, 2026 |
| macOS | |||
| Google Chrome | 149.0.7827.156 | Google Chrome 149.0.7827.156 | Jun 16, 2026 |
| Microsoft Edge | 149.0.4022.80 | Microsoft Edge 149.0.4022.80 | Jun 17, 2026 |
| Linux | |||
| chromium · Debian 12.15 (bookworm) | 149.0.7827.102-1~deb12u1 | DEBIAN-CVE-2026-11684 | Jun 24, 2026 |
| chromium · Debian 13.5 (trixie) | 149.0.7827.102-1~deb13u1 | DEBIAN-CVE-2026-11684 | Jun 24, 2026 |
| chromium · Debian 14 | 149.0.7827.102-1 | DEBIAN-CVE-2026-11684 | Jun 24, 2026 |
| chromium · opensuse-leap 16.0 | 149.0.7827.155-bp160.1.1 | OPENSUSE-SU-2026:21135-1 | Aug 31, 2026 |