CVE-2026-11180: Chrome SVG Cross-Origin Data Leak – Patch & Mitigation Guide

Technical summary

CVE-2026-11180 is a cross-origin data leak vulnerability in Chrome's SVG implementation. The root cause is an inappropriate implementation in the SVG handler that fails to properly enforce same-origin policy boundaries. An attacker crafting a malicious HTML page can exploit this to access sensitive information from cross-origin resources that the victim's browser has access to. The attack vector is network-based with no authentication required, though it does require user interaction (visiting the attacker's page). The vulnerability results in confidentiality loss only; it does not enable data modification or service disruption.

Business impact

This vulnerability poses a direct risk to organizations where employees browse the web using Chrome. An attacker could exfiltrate sensitive business data—such as intranet content, internal APIs, or session-specific information—by embedding malicious SVG content in a webpage and waiting for a user to visit. The impact depends on what cross-origin data is accessible to the victim's session at the time of visit. For security-conscious organizations, this is a confidentiality breach vector that should be addressed promptly.

Affected systems

The vulnerability affects Google Chrome prior to version 149.0.7827.53 across all major operating systems: Windows, macOS, and Linux. The underlying Chromium codebase is shared with other Chromium-based browsers, so confirm whether your organization uses other Chrome derivatives (Edge, Brave, Opera, etc.) and check their patch status separately. Users on Chrome 149.0.7827.53 and later are not vulnerable.

Exploitability

Exploitability is moderate. An attacker must craft a malicious HTML page and convince or trick a user into visiting it—no sophisticated social engineering is required, and standard phishing or ad-placement techniques suffice. Once a user lands on the malicious page, exploitation is automatic and requires no further user action. No special browser settings, extensions, or preconditions are needed. However, the attacker can only leak data that the victim's browser has cross-origin access to, which limits the scope somewhat depending on the target's browsing context and the websites they've visited.

Remediation

Update Google Chrome to version 149.0.7827.53 or later. Chrome's auto-update mechanism will deploy the patch automatically on most systems, but verify completion especially in managed environments. Organizations using Chromium-based alternatives should check those vendors' advisories for equivalent patch versions. Users should also verify they are running the latest version by navigating to chrome://settings/help, which will trigger an immediate check for updates if needed.

Patch guidance

Google released Chrome 149.0.7827.53 with the fix. The patch is available across Windows, macOS, and Linux. For enterprise deployments using Google Chrome for Business or ChromeOS, verify patch deployment through your device management console. If you manage Chrome via group policy (Windows), mobile device management (MDM), or similar controls, confirm that automatic updates are enabled or manually trigger the update to version 149.0.7827.53 or later. No configuration changes or rollback risks are associated with this patch.

Detection guidance

Monitor Chrome version numbers in your environment using endpoint detection and response (EDR) tools or mobile device management systems. Most organizations can detect unpached systems by querying the Chrome version string (found in chrome://version/). Web proxy or firewall logs may show activity from malicious SVG-hosting sites, though this requires prior intelligence on attack infrastructure. Behavioral indicators are limited because the attack is silent from the user's perspective; focus on version inventory rather than event detection.

Why prioritize this

While the CVSS score is 6.5 (Medium), the practical risk is significant because the attack requires only user interaction—a common occurrence in web browsing—and affects a widely deployed browser used by most organizations' employees. The lack of active exploitation in the wild (not listed on CISA's Known Exploited Vulnerabilities catalog) means you have time to plan, but this is not a low-priority patch. Prioritize based on your risk tolerance and the sensitivity of data accessible via your users' cross-origin sessions.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects a Medium severity: network-accessible attack vector, low complexity, no privileges required, but user interaction is mandatory. The impact is confidentiality loss only (high), with no integrity or availability impact. The scope is unchanged (attacker cannot elevate beyond the browser context). This scoring accurately captures the likelihood and impact; however, in practice, the ease of delivering the malicious page and the prevalence of Chrome in enterprise environments may warrant treating this as higher priority than the score alone suggests.

Frequently asked questions