CVE-2026-11084: Chrome Password Manager Cross-Origin Data Leak (v149.0.7827.53)

Technical summary

CVE-2026-11084 stems from an inappropriate implementation in Chrome's password manager component that fails to properly isolate cross-origin data. An attacker can craft a malicious HTML page that, when accessed by a user, exploits this isolation bypass to read or extract sensitive information from different origins. The vulnerability maps to CWE-346 (Origin Validation Error) and CWE-352 (Cross-Site Request Forgery), indicating that the password manager does not adequately enforce same-origin policy constraints. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) reflects network-based attack delivery, low attack complexity, and high confidentiality impact with no integrity or availability consequences.

Business impact

For enterprises and individual users, this vulnerability represents a moderate but real confidentiality risk. If attackers successfully exploit this flaw against employees or executives, they could harvest password manager metadata or cached authentication tokens, potentially facilitating account takeovers or lateral movement within corporate networks. Organizations relying on Chrome for secure browsing should treat this as a meaningful security event that warrants prompt patching, particularly for sensitive workflows. The requirement for user interaction limits blast radius, but targeted spear-phishing campaigns could effectively trigger the vulnerability at scale.

Affected systems

Google Chrome versions prior to 149.0.7827.53 are affected on all major operating systems: Windows, macOS, and Linux. This includes desktop deployments across corporate and consumer environments. The vulnerability does not affect the Chrome kernel itself but rather the password manager module bundled with the browser. Users on older or unsupported Chrome versions, or those with automatic updates disabled, face heightened risk.

Exploitability

Active exploitation requires crafting a convincing or deceptive webpage that lures users into visiting it. No authentication, special privileges, or complex exploitation techniques are needed once a user lands on the attacker's site. The vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities (KEV) catalog, suggesting real-world attacks have not yet been widespread or publicly documented. However, the straightforward nature of delivery (via web link) and moderate severity make this a plausible target for threat actors seeking to harvest credentials from high-value targets.

Remediation

Organizations and users should update Google Chrome to version 149.0.7827.53 or later as soon as possible. For enterprise deployments, administrators should verify patch status via Chrome's built-in update mechanism or through mobile device management (MDM) and endpoint management systems. Users can manually check for updates by navigating to Chrome menu > Help > About Google Chrome, which will automatically download and prompt for installation. Staged rollouts are recommended to ensure stability before organization-wide deployment.

Patch guidance

Google has resolved this vulnerability in Chrome 149.0.7827.53. Verify that your deployed version meets or exceeds this release number. Users on auto-update configurations should receive the patch automatically within days of release. For enterprise Chrome deployments, confirm the update policy is enabled and that deployed instances have checked in within a reasonable window. If manual deployment is required, download the latest Chrome installer from Google's official channels and verify the version after installation. Test functionality in your environment, particularly password manager features, before full rollout.

Detection guidance

Monitor Chrome version inventory across your environment using endpoint detection and response (EDR) tools, mobile device management platforms, or software asset management systems to identify instances running versions prior to 149.0.7827.53. Log analysis of web proxy or firewall appliances may reveal suspicious browsing patterns if employees visit unusual or obfuscated domains, though detecting the exploitation itself in logs is difficult without application-level instrumentation. Consider deploying browser isolation or sandboxing solutions for high-risk users to contain potential cross-origin data leakage. Security awareness training emphasizing caution with unexpected links, especially in email, can reduce the likelihood of users triggering the malicious pages.

Why prioritize this

This vulnerability merits prompt but not emergency-level response. The CVSS score of 6.5 (Medium) and requirement for user interaction prevent it from reaching critical status. However, its network-based delivery mechanism, lack of authentication barriers, and potential to compromise password manager state make it a solid candidate for first-wave patching in any organized update cycle. Organizations with high-value employees targeted by sophisticated phishing campaigns or those in regulated industries should prioritize it ahead of lower-severity items. The absence of active exploitation in the wild provides a reasonable window for planning and testing before deployment.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects a medium-severity issue with high confidentiality impact but no integrity or availability damage. Network-based attack vector (AV:N) and low complexity (AC:L) mean any online user can be targeted with minimal technical barriers. The requirement for user interaction (UI:R) prevents automatic exploitation and limits scope. High confidentiality (C:H) acknowledges that successful exploitation can leak sensitive cross-origin data, aligning with the password manager context where cached credentials or metadata could be exposed. Unchanged scope (S:U) indicates the compromise remains within the affected component boundary.

Frequently asked questions