CVE-2026-11105: Cross-Origin Data Leak in Chrome WebUI

Technical summary

CVE-2026-11105 stems from insufficient input validation in the WebUI layer of Chromium. An attacker with control over the renderer process can craft a malicious HTML page that bypasses security boundaries and extracts cross-origin data that should remain isolated. The vulnerability is classified as CWE-20 (Improper Input Validation) and carries a CVSS 3.1 score of 6.5 (Medium). The attack vector is network-based with low complexity, requires no privileges, but does demand user interaction and only impacts confidentiality—not integrity or availability.

Business impact

Organizations relying on Chrome for sensitive web-based workflows face a potential data exposure risk if renderer compromises occur in their environment. The prerequisite of a compromised renderer process means this is typically part of a multi-stage attack chain, rather than a standalone vulnerability. However, once the renderer is compromised, any sensitive data in the user's browsing context—such as authentication tokens, form data, or third-party service information—becomes accessible to the attacker. This elevates the value of renderer exploits and underscores the importance of defense-in-depth strategies.

Affected systems

Google Chrome versions prior to 149.0.7827.53 are vulnerable. Chrome runs on multiple operating systems, including Windows, macOS, and Linux, so the exposure is broad across platforms. Users and organizations running outdated Chrome instances are at risk.

Exploitability

Exploitation requires that an attacker has already compromised the Chrome renderer process through another vulnerability or attack method. This is a non-trivial prerequisite, which reduces the standalone exploitability of CVE-2026-11105. However, once the renderer is controlled, triggering the vulnerability is relatively straightforward—the attacker simply needs to serve a crafted HTML page that the user visits. No additional user interaction beyond normal browsing is required beyond the initial click. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog, suggesting no active in-the-wild exploitation has been publicly documented at this time.

Remediation

Update Google Chrome to version 149.0.7827.53 or later. Google has designated this a Medium-severity issue and has included a fix in the specified release. Verify the patched version on all systems running Chrome. Additionally, organizations should reinforce other defenses against renderer compromise—such as sandboxing, process isolation, and Site Isolation features that Chrome provides by default—to reduce the likelihood of the prerequisite condition occurring.

Patch guidance

Deploy Google Chrome 149.0.7827.53 or any subsequent release. Verify the update has been applied by navigating to Chrome's Settings > About Chrome, which will display the currently installed version and automatically check for updates. For enterprise environments, use Chrome policy updates to enforce deployment of the patched version. Test in a non-production environment first, though this patch addresses only a Medium-severity issue and should not introduce breaking changes.

Detection guidance

Monitor for unusual access patterns or cross-origin data exfiltration from Chrome processes in your environment. Examine browser console logs and network traffic for unexpected API calls or data transfers between unrelated domains. If you suspect a renderer has been compromised, look for signs of prior exploitation—such as anomalous child process creation, suspicious plugin/extension behavior, or memory corruption artifacts. Endpoint detection and response (EDR) tools should flag renderer crashes or restarts that could indicate exploitation attempts. Note that this vulnerability alone does not generate obvious network signatures; detection relies on identifying the renderer compromise that precedes it.

Why prioritize this

While the CVSS score is 6.5 (Medium), the requirement for a prior renderer compromise substantially lowers the standalone risk. Organizations should prioritize patching as part of regular Chrome maintenance schedules but should not elevate it above critical business interruption or high-severity vulnerabilities with direct attack vectors. However, if renderer exploits are actively being used in your threat landscape, this vulnerability becomes more relevant because it amplifies the damage from those initial compromises.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects a network-accessible vulnerability with low attack complexity and user interaction required, but significant confidentiality impact. The vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) correctly captures that the vulnerability does not require prior privileges, demands interaction (the user must visit a page), and is scoped to the user's browsing session. The Medium severity is appropriate given the prerequisite of renderer compromise, which CVSS models indirectly through its interaction and complexity factors. Organizations with robust sandboxing and Site Isolation should see reduced real-world risk.

Frequently asked questions