CVE-2026-11161: Chrome DataTransfer Cross-Origin Data Leak

Technical summary

CVE-2026-11161 stems from an inappropriate implementation in Chrome's DataTransfer mechanism, which governs how data moves between different security origins in the browser. The vulnerability is classified as CWE-346 (Origin Validation Error), indicating that Chrome fails to properly validate or enforce origin boundaries during data transfer operations. An attacker-controlled HTML page can be weaponized to exfiltrate cross-origin data by exploiting this validation gap. The Chromium project assigned this a Medium severity rating, reflecting the need for user interaction and the limited scope of exposure per successful attack.

Business impact

Data leakage through cross-origin data transfer bypasses the same-origin policy, a cornerstone of web application security. For organizations, this means credentials, session tokens, personal information, or confidential business data visible in a user's browser could be accessed by malicious websites. The impact scales with the sensitivity of data users access in their browsers—financial services, healthcare platforms, and internal tools are particularly at risk. Each successful exploit affects only the targeted user's session, limiting mass-compromise potential but creating targeted phishing and supply-chain attack vectors.

Affected systems

The vulnerability affects Google Chrome on Windows, macOS, and Linux systems running versions prior to 149.0.7827.53. While the CVE references Chrome, the underlying Chromium project serves as the foundation for multiple Chromium-based browsers (Edge, Opera, Brave, etc.); organizations should verify patch status across all Chromium derivatives in their environment. Users on older Chrome release channels (Extended Stable, etc.) may lag behind standard updates.

Exploitability

Exploitation requires user interaction—a victim must visit or interact with an attacker-controlled webpage. No user authentication bypass, plugin installation, or elevated privileges are needed. The attack is network-accessible and straightforward to deploy via malicious links in phishing emails, compromised websites, or watering hole attacks. While not trivially exploited in the wild without a functional payload, the attack surface is broad given Chrome's ubiquity and the prevalence of web browsing. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog, suggesting limited active exploitation in the public domain as of the publication date.

Remediation

Users and administrators must update Google Chrome to version 149.0.7827.53 or later. Chromium-based browsers (Edge, Brave, Opera) should be checked for analogous patched versions, as they may bundle the same vulnerable code. Browser auto-update mechanisms on Windows and macOS will deliver patches automatically, but administrators managing locked-down deployments should verify patch deployment through their distribution channels. No workarounds exist; patching is the only mitigation.

Patch guidance

Update Chrome via Settings > About Chrome, which will automatically download and install the latest version (149.0.7827.53 or newer) and prompt for restart. For enterprise deployments, verify patch status through Chrome Enterprise console or device management systems. If your organization uses Chromium-based alternatives (Edge, Brave), check their respective vendor advisories for patch availability and version numbers. Prioritize patching for users who access sensitive web applications or internal services in their browsers.

Detection guidance

Monitor for Chrome version drift in your environment using endpoint management tools or browser telemetry. Alert on users running Chrome versions below 149.0.7827.53. Analyze web logs for unusual cross-origin requests or data exfiltration patterns, though this vulnerability does not create obvious network signatures. Deploy web filtering to block known phishing campaigns that may exploit this flaw. Track CISA advisories and vendor security bulletins for indicators of active exploitation.

Why prioritize this

While the CVSS score of 4.3 reflects a Medium severity, the broad deployment of Chrome, the simplicity of the attack vector, and the potential for targeted data exfiltration warrant prompt patching. Organizations with high-value users (executives, engineers, financial staff) who access sensitive data in browsers should prioritize this update. The lack of KEV designation suggests this is not yet widely weaponized, providing a window to patch before attacker interest increases.

Risk score, explained

The CVSS 3.1 score of 4.3 (Medium) reflects a network-accessible vulnerability with low attack complexity, requiring only user interaction, and resulting in confidentiality impact without integrity or availability loss. The score appropriately captures the sneaky nature of data leakage—hard to detect and damaging to privacy—while acknowledging the dependency on user interaction and the lack of remote code execution or privilege escalation. For organizations handling sensitive web-based data, the real-world risk may exceed this base score if users regularly interact with untrusted websites.

Frequently asked questions