> CVE-2026-11289

« BACK_TO_HOME
PUBLISHED
2026-06-05 00:17
MODIFIED
2026-06-05 00:17
EPSS (Prob. Exploit)
0.20%
Top 90.5%
DATA SOURCES:
NVD 🔗 2026-06-05 CWE MITRE 🔗 2026-11-01 FIRST EPSS 🔗 2026-11-01 GITHUB 🔗 2026-11-05 MSRC 🔗 2026-11-02

> DESCRIPTION

Side-channel information leakage in Paint in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> WEAKNESSES

CWE-1300

> CWE DETAILED DESCRIPTIONS

CWE-1300: Improper Protection of Physical Side Channels - The device does not contain sufficient protection mechanisms to prevent physical side channels from exposing sensitive information due to patterns in physically observable phenomena such as variations in power consumption, electromagnetic emissions (EME), or acoustic emissions.

> GITHUB SECURITY ADVISORY

GHSA-gg2r-wvfm-q9rx HIGH

Pillow: MSP RLE decoder expands a tiny file into unbounded memory

AFFECTED PACKAGES:
PIP / pillow
>= 4.1.0, < 13.0.0
Fixed in: 13.0.0

> HISTORIQUE DES MODIFICATIONS

Première apparition
05/06/2026 00:17
Source: NVD
📊 ENRICHISSEMENT 01/07/2026 06:01
CWE
Champ modifié: Description CWE
Ancienne valeur:
N/A
Nouvelle valeur:
CWE-1300: Improper Protection of Physical Side Channels - The device does not contain sufficient protection mechanisms to prevent physical side channels from exposing sensitive information due to pa...
Total des modifications: 1 Dernière mise à jour: 4 months ago

> REFERENCES

https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop....
https://issues.chromium.org/issues/502239897
« BACK_TO_HOME