CVE-2026-11162: Chrome CSS Cross-Origin Data Leak Vulnerability

Technical summary

CVE-2026-11162 is a CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) vulnerability stemming from inappropriate CSS implementation in Chrome's rendering engine. The flaw permits a network-based attacker to craft an HTML page that, when loaded by a user, exploits CSS parsing or application logic to read cross-origin data that should be protected by the Same-Origin Policy. The CVSS 3.1 score of 4.3 (Medium) reflects the requirement for user interaction and the confidentiality-only impact, with no elevation of privilege or availability concerns.

Business impact

Organizations whose employees rely on Chrome as their primary browser face potential exposure of sensitive business data if users visit compromised or malicious sites. This is particularly concerning for teams handling multi-tab workflows involving authentication tokens, private documents, or cross-domain applications. While the vulnerability requires user action to trigger, the ease of delivery via a crafted webpage and the potential breadth of exposed data mean that affected users could leak credentials, proprietary information, or personal data without awareness. The impact scales with how many users access sensitive web applications in Chrome.

Affected systems

The vulnerability affects Google Chrome on Windows, macOS, and Linux systems running versions prior to 149.0.7827.53. Because Chrome is distributed across multiple operating systems and automatically updates on most configurations, the risk population depends on organizational Chrome deployment practices and update cadence. Users on older versions or organizations with delayed update policies face the highest exposure.

Exploitability

Exploitability is moderate. The attack requires a user to visit a crafted HTML page (network-accessible, low attack complexity), but does require user interaction—the user must click the link or visit the attacker's site. No authentication is needed. Once delivered, the CSS-based exploit operates client-side without requiring specific system configuration or software beyond the vulnerable browser version. The barrier to weaponization is low, though the attack depends on social engineering or compromised third-party content to direct users to the malicious page.

Remediation

Update Google Chrome to version 149.0.7827.53 or later. Most Chrome installations update automatically; verify completion by opening Chrome menu → Help → About Google Chrome. For enterprise deployments with managed update policies, confirm that update distribution has completed across your fleet. No workarounds are available; patching is the only mitigation.

Patch guidance

Verify that Chrome has updated to 149.0.7827.53 or a later stable release. On Windows, macOS, and Linux, users can check Settings → About Chrome, which will display both the current version and initiate updates if available. Organizations using Chrome Enterprise or Chromebook management should verify policy-based rollout via their Admin Console. Test critical multi-tab workflows after update to confirm no regression in application functionality.

Detection guidance

Monitor Chrome version inventory in your environment to ensure no systems remain on pre-149.0.7827.53 builds. Endpoint Detection and Response (EDR) tools can flag Chrome versions against a baseline; many vulnerability scanners now include Chrome version checks. Browser usage logs may help identify which users accessed external or untrusted sites around the time the vulnerability was active, though post-compromise attribution is difficult. Consider network controls limiting access to known malicious domains, though the vulnerability itself does not generate distinctive network signatures.

Why prioritize this

Despite a Medium CVSS score, this vulnerability merits prompt attention because it enables silent data leakage across a widely-used browser. The low attack complexity, minimal user friction (clicking a link), and potential for exfiltrating high-value credentials or business data mean that it poses a non-trivial business risk. However, it is not critical because it requires active user participation and does not enable code execution or lateral movement. Organizations should patch within their standard critical or high-priority update windows (within 1–2 weeks of availability).

Risk score, explained

The CVSS 3.1 score of 4.3 reflects a network-based attack (AV:N), low attack complexity (AC:L), no special privileges required (PR:N), and the necessity of user interaction (UI:R). The impact is limited to confidentiality loss (C:L) with no integrity or availability compromise (I:N, A:N). This places the issue in the Medium band. In practice, the true business risk may be higher if your organization handles sensitive data in web applications, because the ease and stealth of exploitation could lead to undetected breaches; however, the absence of privilege escalation, code execution, or service disruption justifies the Medium technical rating.

Frequently asked questions