CVE-2026-11129: Chrome Extension Cross-Origin Data Leak Vulnerability

Technical summary

CVE-2026-11129 is a cross-origin data leak vulnerability in the Chrome Extensions implementation (Chromium security severity: Medium). The vulnerability stems from an inappropriate implementation that fails to enforce proper isolation between extension contexts and cross-origin data, allowing a remote attacker to exfiltrate sensitive information via a crafted HTML page. The flaw is classified under CWE-352 (Cross-Site Request Forgery), indicating a weakness in cross-origin request handling or validation. Exploitation requires user interaction (visiting a malicious page) but no authentication or special privileges. The attack surface is broad due to Chrome's ubiquity across operating systems.

Business impact

For organizations, this vulnerability poses a data exfiltration risk if employees use Chrome to access internal applications or cloud services. An attacker could potentially harvest session tokens, API keys, or confidential information from multiple tabs or origins simultaneously. The attack is silent and difficult to detect from the user's perspective. Organizations with strict data governance policies and those handling regulated data (PII, financial records, healthcare information) face elevated compliance and reputational risk until patching is complete. The need for user interaction (visiting a malicious site) somewhat limits the scope compared to fully remote attacks, but phishing and drive-by download campaigns could reliably trigger exploitation.

Affected systems

Google Chrome and Chromium-based browsers running versions prior to 149.0.7827.53 are affected. The vulnerability impacts Chrome on Microsoft Windows, Apple macOS, and Linux systems. Other Chromium-based browsers (such as Edge, Brave, Opera) may also be affected depending on their release cycle and patch status relative to the upstream Chromium fix. Organizations should verify version status across all Chromium derivatives in use.

Exploitability

The attack requires relatively low complexity and can be initiated over the network. A remote attacker must craft a malicious HTML page and convince or trick a user into visiting it—accomplished through phishing emails, compromised advertisements, malicious links, or social engineering. Once a user with Chrome open visits the page, the attacker can begin exfiltrating cross-origin data without additional user consent or interaction beyond the initial page load. The straightforward nature of the attack vector and the commonality of extensions in Chrome installations increase practical exploitability. The vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, but the simplicity of the attack pattern suggests rapid weaponization is likely once public details emerge.

Remediation

Immediately update Google Chrome to version 149.0.7827.53 or later. Chrome's auto-update mechanism typically handles this transparently, but administrators should verify completion across their fleet. For enterprise deployments, use Chrome's Group Policy or MDM controls to enforce the minimum version. Additionally, audit which extensions are installed in your environment and disable or remove unnecessary extensions to reduce the attack surface. Consider implementing content security policies and monitoring extension behavior through Chrome's enterprise reporting tools.

Patch guidance

Google Chrome will automatically update to patched versions 149.0.7827.53 and later. Verify the update by navigating to Chrome menu > Help > About Google Chrome; the browser will check for updates and display the current version. Enterprise administrators should confirm patch deployment via their MDM console or Group Policy audit logs. For Chromium-based browsers (Edge, Brave, etc.), check each vendor's release cycle; Microsoft Edge typically receives patches within days of Chromium releases. Ensure all users and machines are running the patched version before considering the vulnerability remediated.

Detection guidance

Monitor for successful exploitation by reviewing Chrome extension audit logs and user browsing history for unexpected cross-origin data access patterns, particularly from lesser-known or recently installed extensions. Implement network-level detection by identifying HTTP requests originating from compromised browsing sessions that access data from unexpected origins. Browser telemetry logs (if enabled in your organization) can reveal extension behavior anomalies. Look for signs of phishing campaigns that might precede exploitation attempts. Security teams should also monitor threat intelligence feeds for proof-of-concept or exploit code targeting CVE-2026-11129.

Why prioritize this

Despite a medium CVSS score of 6.5, this vulnerability merits high prioritization due to the ubiquity of Chrome, the ease of crafting a malicious page, and the sensitivity of data at risk (session tokens, credentials, confidential communications). The requirement for user interaction prevents it from being critical, but the likelihood of successful exploitation via phishing and the silent nature of the attack elevate real-world risk. Organizations handling sensitive data or operating in regulated industries should prioritize patching within one business week.

Risk score, explained

The CVSS 3.1 score of 6.5 (Medium) reflects: Network-based attack vector (AV:N) requiring no special network conditions (AC:L), no authentication (PR:N), but requiring user interaction to visit a malicious page (UI:R). The impact is confined to confidentiality (C:H)—the attacker can read cross-origin data—with no integrity or availability impact (I:N, A:N). The score appropriately captures the real but not critical risk; user interaction requirement and lack of code execution prevent a higher rating, while the sensitive nature of data at risk justifies the medium-to-higher range within that severity level.

Frequently asked questions