CVE-2026-11135: Chrome Autofill Bypass Allows Credential Misdirection

Technical summary

CVE-2026-11135 is a policy enforcement bypass in the Chromium Autofill subsystem. The vulnerability (CWE-284: Improper Access Control) stems from insufficient validation of autofill policies when processing HTML page content. An unauthenticated remote attacker can craft a malicious HTML page that, when visited by a user, exploits the autofill mechanism to override or circumvent intended access controls. The attack vector is network-based with low complexity, but requires user interaction. The impact is integrity-focused: attackers can modify the information flow without gaining confidentiality access or causing availability disruption. Chromium categorizes this as medium severity.

Business impact

This vulnerability creates risk in scenarios where employees use Chrome for accessing internal systems, banking portals, or form-based workflows. An attacker could craft a convincing phishing page that intercepts and modifies autofilled credentials or sensitive form data, redirecting submissions to attacker-controlled endpoints. While not a direct data theft vector, it amplifies phishing and social engineering campaigns by leveraging browser trust in stored credentials. Organizations relying on Chrome in regulated environments (finance, healthcare, legal) should assess whether this affects compliance posture for data integrity controls.

Affected systems

The vulnerability affects Google Chrome on Windows, macOS, and Linux. All Chrome versions prior to 149.0.7827.53 are vulnerable. Users of Chromium-based browsers (Edge, Brave, Opera, etc.) may be affected depending on their Chromium version; verify the specific browser vendor's advisory for version alignment. The underlying issue is in the Chromium project, so patch timing varies by downstream vendor.

Exploitability

Exploitation requires social engineering—the attacker must trick a user into visiting a malicious website. The crafted HTML page does the heavy lifting; no client-side exploits, memory corruption, or zero-click mechanisms are involved. This lowers the technical bar but means success depends on user deception. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating no evidence of widespread active exploitation in the wild as of the last KEV update. However, the straightforward attack pattern (phishing + malicious page) makes it a likely target for opportunistic attackers once patches lag in real-world deployments.

Remediation

Update Google Chrome to version 149.0.7827.53 or later. For enterprise environments, use Chrome update policies to enforce deployment across managed devices. Verify that downstream Chromium-based browsers (Edge, Brave, etc.) have received corresponding patches and schedule updates accordingly. No workarounds exist; patching is the only mitigation.

Patch guidance

Prioritize patch deployment for Chrome within 2–4 weeks of the published date (June 4, 2026). For organizations with auto-update enabled, no manual action is required. For manual update workflows: navigate to Chrome Menu > Help > About Google Chrome, which will check for and install available updates. On Windows, macOS, and Linux, the process is identical. For enterprise deployments using Google Admin Console, create a Chrome update policy targeting version 149.0.7827.53 or newer and communicate the deadline to end users. Test patches in a staging environment first if your organization manages Chrome via group policy or MDM.

Detection guidance

Monitor Chrome version adoption across your environment using endpoint visibility tools (EDR, MDM, asset inventory). Flag any devices running Chrome versions below 149.0.7827.53 for prioritized patching. At the perimeter, monitor for phishing emails or credential-harvesting campaigns that reference autofill functionality or promise form-filling convenience. Browser telemetry (where available) may flag unusual autofill behavior; review Chrome security logs if your organization has enabled incident reporting. No network signatures can reliably detect this exploit class since the attack surface is the rendered HTML page itself.

Why prioritize this

CVSS 6.5 (Medium) with user interaction requirement and no KEV listing keeps this vulnerability moderate in urgency. However, it directly enables phishing and credential misdirection—threats with proven ROI for attackers. The simplicity of the attack (send phishing link, let the browser's trust in autofill do the work) warrants faster patching than the CVSS score alone suggests. Patch within 30 days; prioritize any Chrome instances used for sensitive workflows (banking, HR systems, email access).

Risk score, explained

The CVSS 6.5 score reflects network accessibility, low complexity, user interaction, and integrity-only impact. The score appropriately penalizes the requirement for user deception but does not amplify the social engineering dimension. In real-world risk modeling, factor in your organization's phishing susceptibility, reliance on autofill for sensitive workflows, and the maturity of your end-user security awareness program. Organizations with strong email filtering and user training can tolerate slightly longer patch windows; those with high-risk user populations should prioritize sooner.

Frequently asked questions