CVE-2026-11142: Chrome Paint Same-Origin Policy Bypass Vulnerability

Technical summary

CVE-2026-11142 describes insufficient policy enforcement within Chrome's Paint subsystem that permits same-origin policy circumvention. The vulnerability resides in how Chrome validates and enforces origin restrictions during Paint operations, allowing a network attacker to craft HTML content that, when loaded by a user, violates the expected isolation between different origins. The flaw is classified as CWE-639 (Authorization through User-Controlled Key), reflecting a breakdown in proper origin verification during a sensitive browser operation. This is a client-side bypass requiring user navigation to the malicious page.

Business impact

Successful exploitation undermines the foundational security model of web browsers—the same-origin policy. An attacker leveraging this vulnerability could potentially access user data from other websites, modify content in ways the user does not expect, or perform actions on behalf of the user across different origins. For organizations whose users rely on multi-tab browsing or web-based applications, this creates cross-site integrity violations that could affect authentication tokens, session data, or sensitive user information. The impact is heightened in environments with privileged web applications or sensitive SaaS platforms.

Affected systems

Google Chrome versions prior to 149.0.7827.53 are vulnerable. The vulnerability affects Chrome on all major platforms: Windows, macOS, and Linux systems running vulnerable browser versions. While the vulnerability is in Chrome itself, the operating systems listed (Windows, macOS, Linux) indicate the breadth of affected platforms. Users on any of these systems running an older Chrome version are at risk.

Exploitability

Exploitation requires a user to visit a crafted webpage, making this a network-based attack with low attack complexity and no elevated privileges needed. The CVSS vector reflects this: the attack is unauthenticated and remotely deliverable. However, it does require user interaction—specifically, the user must navigate to the attacker's page or a compromised legitimate page hosting the payload. This is not passively exploitable but is relatively straightforward to deliver via social engineering, malicious ads, or compromised websites. The vulnerability is not currently listed in the CISA KEV catalog, indicating no evidence of active weaponization or in-the-wild exploitation as of the publication date.

Remediation

Update Google Chrome to version 149.0.7827.53 or later. Chrome's auto-update mechanism typically deploys patches automatically, but users can manually verify their version via Chrome's settings (Help > About Google Chrome). Organizations should ensure their Chrome deployments, including managed instances, are updated. No workarounds exist; patching is the only mitigation.

Patch guidance

Deploy Chrome 149.0.7827.53 or a subsequent stable release. Organizations using Chrome managed policies should test the patch in a limited environment before full rollout to ensure compatibility with business-critical web applications. Chrome's frequent update cadence means this patch will be superseded by newer versions; ensure internal monitoring confirms the presence of a patched version. Verify the installed version matches or exceeds 149.0.7827.53 using the browser's about page or enterprise management tools.

Detection guidance

Detection is challenging at the network level since the attack relies on user navigation to a crafted page. Monitor for unusual browser crashes or instability following user visits to untrusted sites, though this is not definitive. Endpoint detection should focus on ensuring Chrome versions are current via asset inventory or mobile device management (MDM) tools. Web proxies and security information and event management (SIEM) systems can log visits to known malicious domains, but the vulnerability itself does not produce distinctive network signatures. Organizations should prioritize patch validation and version compliance scanning.

Why prioritize this

This vulnerability merits prompt attention despite its MEDIUM severity and lack of KEV listing. Same-origin policy bypasses are fundamental browser security breaks that, while limited in scope to Paint operations, could enable credential theft or malicious content injection. The low attack complexity and user-interaction requirement make this exploitable at scale via social engineering. Organizations should prioritize patching within their standard update windows—typically within 1–2 weeks of release. This is not an emergency patch requiring immediate out-of-band deployment, but it should not be deferred.

Risk score, explained

The CVSS 3.1 score of 6.5 (MEDIUM) reflects a remotely exploitable vulnerability (AV:N, AC:L, PR:N) that requires user interaction (UI:R) and results in integrity impact (I:H) but no confidentiality or availability loss (C:N, A:N). The score appropriately captures that this is a boundary-crossing integrity violation rather than a data leak or denial-of-service. The absence of confidentiality impact distinguishes this from more severe same-origin bypasses, though the integrity dimension is significant. The MEDIUM rating aligns with Chromium's own severity assessment.

Frequently asked questions