CVE-2026-11179: Chrome ORB Site Isolation Bypass (CVSS 8.8)

Technical summary

The vulnerability exists in Chrome's ORB (Object Request Broker) implementation, which is part of the browser's cross-origin resource sharing and isolation mechanisms. CWE-284 (Improper Access Control) indicates that the ORB fails to properly enforce access restrictions between origins. An attacker crafts an HTML page that triggers improper ORB behavior, allowing script execution to escape the site isolation sandbox. This violates the fundamental trust boundary that Chrome maintains to isolate site data, potentially exposing cookies, localStorage, session tokens, or DOM content from other origins within the same browser context.

Business impact

Site isolation bypass represents a critical user-facing risk. Attackers can harvest authentication credentials, session tokens, and sensitive user data from any site the victim has open simultaneously. For enterprises where employees use Chrome for business, this enables lateral movement after initial social engineering (phishing to the malicious page). Users managing financial accounts, email, or SaaS platforms face direct account compromise. The CVSS score of 8.8 (HIGH) reflects the confluence of confidentiality, integrity, and availability impacts across the user's browser state.

Affected systems

Google Chrome on all major platforms—Windows, macOS, and Linux—is affected in versions prior to 149.0.7827.53. The vulnerability affects the Chrome binary and associated ORB components across all these operating systems. Users running Chrome 149.0.7827.53 or later are protected.

Exploitability

This vulnerability has a low barrier to exploitation. An attacker needs only to craft a malicious HTML page and trick a user into visiting it (via phishing, watering hole, or ad network compromise). No special network position, authentication, or advanced techniques are required. The attack surface is the web itself—any site or embed can host the payload. However, the vulnerability is not currently listed on the CISA KEV catalog, suggesting limited evidence of active, widespread exploitation in the wild as of the publication date.

Remediation

Immediate patching to Chrome 149.0.7827.53 or later is the only mitigation. Users should enable automatic updates or manually update via Settings > About > Google Chrome. Administrators managing Chrome on enterprise devices should deploy this version through their standard patch management tools. There are no known workarounds for the underlying ORB flaw; updating the browser is essential.

Patch guidance

Verify your Chrome version by navigating to chrome://version/. If the version is below 149.0.7827.53, initiate an update immediately. Chrome typically auto-updates, but you can force a check by clicking the menu (three dots), selecting 'About Google Chrome,' and allowing the download and restart. For macOS, Windows, and Linux users, the patch process is identical. Enterprise deployments should push 149.0.7827.53 or later through their configuration management system. After patching, confirm the browser version has changed before resuming normal browsing.

Detection guidance

Monitor Chrome version compliance across your organization using endpoint detection tools or Mobile Device Management (MDM) solutions. Flag any systems running Chrome versions below 149.0.7827.53 for immediate patching. Additionally, monitor for suspicious activity patterns in user accounts (unusual login locations, new device registrations) that might indicate credential theft via site isolation bypass. Web proxies or DNS logs cannot block this attack since the malicious page can be hosted anywhere; detection relies on version inventory and behavioral anomalies in user accounts.

Why prioritize this

This vulnerability merits urgent attention due to the HIGH CVSS score (8.8), low attack complexity, and the fundamental nature of site isolation as a Chrome security pillar. Even without current KEV listing, the ease of exploitation and potential for widespread credential theft in any environment where users browse untrusted content makes this a top-tier patch priority. Delay increases the window for targeted exploitation, particularly in social engineering campaigns.

Risk score, explained

The CVSS 3.1 score of 8.8 reflects: (1) Network accessibility (AV:N) with no authentication required (PR:N); (2) low attack complexity (AC:L), meaning the attack does not require user-specific conditions beyond clicking a link; (3) user interaction (UI:R) is required—the victim must visit the malicious page; (4) high confidentiality, integrity, and availability impacts (C:H/I:H/A:H) because the attacker can read cross-origin data, inject content, or destabilize the browser state. The boundary between HIGH (CVSS 7.0–8.9) and CRITICAL (9.0+) is crossed by the UI:R requirement, which introduces friction. Nevertheless, 8.8 correctly signals a severe flaw demanding immediate remediation.

Frequently asked questions