CVE-2026-11027: Chrome Glic Input Validation Flaw Enables Cross-Origin Data Leakage

Technical summary

CVE-2026-11027 is an insufficient input validation flaw (CWE-20) in Glic affecting Chrome versions prior to 149.0.7827.53. The vulnerability allows cross-origin data leakage when a remote attacker controls a crafted HTML page and has already compromised the Chrome renderer process. The attack surface is network-based with low complexity; user interaction (clicking or viewing the malicious page) is required. The vulnerability is confined to confidentiality impact with no integrity or availability effects.

Business impact

This vulnerability poses a targeted data exfiltration risk for organizations where employee browsers may be compromised or where sophisticated social engineering delivers malicious content. The requirement for prior renderer compromise limits opportunistic exploitation but represents a real escalation path in multi-stage attacks. Industries handling sensitive per-user data (finance, healthcare, government) face elevated risk if browser compromise occurs alongside this flaw.

Affected systems

Google Chrome prior to version 149.0.7827.53 is directly affected. While the source lists macOS, Linux kernel, and Windows as vendor_products, these appear to be platform listings rather than distinct vulnerability vectors—the flaw resides in Chrome's Glic component regardless of operating system. Verify Chrome version and apply the patch across all supported platforms.

Exploitability

Exploitation requires two preconditions: first, the attacker must already control the Chrome renderer process (a separate compromise), and second, the user must interact with a crafted HTML page. This two-stage requirement significantly reduces widespread opportunistic exploitation risk. However, in targeted scenarios—such as supply-chain compromise or persistent threat campaigns—combining renderer compromise with this input validation flaw becomes practical. The attack is not known to be actively exploited in the wild (KEV status: No).

Remediation

Update Google Chrome to version 149.0.7827.53 or later immediately. This patch addresses the input validation flaw in Glic. No workarounds short of disabling Glic or running Chrome in a restricted sandbox are available. Organizations should prioritize patching in environments where renderer compromise is a credible threat model.

Patch guidance

Deploy Chrome version 149.0.7827.53 or newer across your organization using your standard browser deployment tools (Google Update, MDM, package managers). Verify successful patch application by checking chrome://version in the address bar. If you manage Chrome policy via Google Admin Console or enterprise policies, ensure autoupdate is enabled and monitor rollout completion. Consider staged rollout if you have mission-critical workflows requiring pre-patch validation.

Detection guidance

Monitor Chrome version inventory to identify instances below 149.0.7827.53. Look for unusual JavaScript console errors or cross-origin data access patterns that correlate with users visiting external websites. Renderer process crashes or unexpected memory spikes may indicate exploit attempts. In forensic analysis of suspected compromise, check for crafted HTML files in browsing history or cached files that correlate with timing of data exfiltration events. Security event correlation with renderer process compromise indicators (e.g., from EDR tools) should trigger elevated alerting.

Why prioritize this

Although this vulnerability requires prior renderer process compromise, making it a secondary exploit in attack chains rather than a primary vector, the confidentiality impact (cross-origin data leakage) in a browser context warrants prompt patching. The combination of network attack surface, user interaction requirement, and medium CVSS score (6.5) places it in the 'urgent but not critical' tier. Organizations with high-risk browser populations should patch within 1–2 weeks; others within 4 weeks.

Risk score, explained

CVSS 6.5 (Medium) reflects high confidentiality impact balanced against the prerequisite of renderer compromise and required user interaction. The attack vector is network-based and complexity is low once the preconditions are met. The severity aligns with Chromium's own Medium classification. No integrity or availability impact is present. For most organizations, this is a medium-priority patch; for those with advanced threat models incorporating persistent renderer compromise, it merits higher priority.

Frequently asked questions