CVE-2026-11133: Chrome Paint Same-Origin Policy Bypass

Technical summary

CVE-2026-11133 stems from insufficient policy enforcement in Chrome's Paint implementation. The same-origin policy (SOP) is a foundational browser security mechanism that isolates scripts and data between different origins, preventing unauthorized cross-origin access. CWE-346 (Origin Validation Error) indicates the application fails to properly validate or enforce origin boundaries. An attacker crafts malicious HTML that exploits this weakness, allowing code execution or data access across origin boundaries. The vulnerability is rated CVSS 6.5 (Medium) with a vector indicating network-based attack, low complexity, and no privileges required—but user interaction is necessary. Chromium has classified this as Medium severity.

Business impact

Successful exploitation could result in unauthorized access to sensitive user data across different web origins, session hijacking, credential theft, or unauthorized modifications to web application state. For enterprises, this threatens the security of web-based applications and user accounts accessed through affected Chrome versions. The requirement for user interaction (clicking a link or visiting a page) limits mass exploitation but remains a practical risk in social engineering or supply-chain scenarios. Organizations relying on SOP as a security control for sensitive web applications should treat this as a priority update.

Affected systems

Google Chrome prior to version 149.0.7827.53 is the primary affected product. The vulnerability also impacts Chrome on Windows, macOS, and Linux systems. Organizations should verify their Chrome deployment versions across all endpoints, including enterprise and consumer devices, as well as web applications embedded in or interacting with Chrome.

Exploitability

Exploitability is moderate. The attack requires crafting a malicious HTML page and delivering it to a user—typically through phishing, malicious ads, or compromised websites. No special network position, authentication, or elevated privileges are required. However, the user must visit the attacker's page or interact with it (clicking elements, navigating content) for the exploit to trigger. This makes it practical but not automated or worm-like. No public exploit code or CISA KEV status is currently recorded, reducing imminent real-world risk, though motivated actors may rapidly develop and deploy exploits.

Remediation

Update Google Chrome to version 149.0.7827.53 or later. The update patches the insufficient policy enforcement in Paint. On Windows, macOS, and Linux, use the built-in auto-update mechanism (Chrome typically checks for updates on startup) or manually navigate to Settings > About Chrome to trigger an immediate check. Verify successful patching via Settings > About Chrome, which displays the current version. For enterprise deployments using Google Admin Console, configure auto-update policies and monitor update status across managed devices.

Patch guidance

Patches are available in Chrome 149.0.7827.53 and later releases. Google's auto-update system should deliver the patch automatically to most users within days. Enterprise administrators should verify patch deployment through Google Admin Console reports and confirm version numbers across their fleet. Testing should focus on validating that the same-origin policy is properly enforced and that the Paint feature does not inadvertently allow cross-origin access. No breaking changes or compatibility regressions have been reported.

Detection guidance

Monitor Chrome version numbers across your environment using MDM/EMM solutions or enterprise reporting tools. Look for instances below version 149.0.7827.53. Network-based detection is limited because the attack is client-side and requires user interaction; it manifests as a benign-looking HTML page visit. Endpoint detection should focus on version inventory. If concerned about targeted attacks, monitor for suspicious web traffic to known malicious domains or phishing campaigns that might deliver the exploit page. Web application firewalls cannot effectively block this because the vulnerability is in the browser's policy enforcement, not the network or web server.

Why prioritize this

Prioritize this update because it directly undermines browser-level security isolation (same-origin policy), which protects against unauthorized cross-origin data access and session hijacking. Although the CVSS score is Medium and user interaction is required, the impact on confidentiality and integrity is significant for any web application or service relying on SOP. Rapid patching prevents attackers from weaponizing this against high-value targets. The broad deployment of Chrome across enterprise and consumer devices means delayed patching creates an expanding window of vulnerability.

Risk score, explained

CVSS 6.5 reflects a Medium severity with high integrity impact (I:H, unauthorized modification) but no confidentiality impact in the score vector, moderate attack complexity, and network accessibility. The score appropriately reflects the practical threat: network-based, easy to execute, but requires user interaction. The lack of KEV status indicates CISA has not yet confirmed active exploitation in the wild, but this should not delay patching, as the vulnerability's technical nature (SOP bypass) makes it valuable to attackers. Organizations should treat this as a standard-priority patch to deploy within 2–4 weeks.

Frequently asked questions