CVE-2026-11184: Chrome Navigation Policy Bypass via Crafted HTML

Technical summary

The vulnerability stems from insufficient policy enforcement in Chrome's Actor component, categorized under CWE-602 (Client-Side Enforcement of Server-Side Security). The flaw permits a remote, unauthenticated attacker to craft HTML content that evades Chrome's navigation policy restrictions. The CVSS 3.1 score of 6.3 (Medium severity) reflects a network-exploitable vector with low attack complexity; however, exploitation requires user interaction (visiting the malicious page) and impacts confidentiality, integrity, and availability at a low level per the affected scope. Chromium project initially assessed this as Medium severity.

Business impact

For enterprise users, this vulnerability creates a targeted phishing vector. An attacker could host a malicious site designed to redirect users in unexpected ways or cause navigation to untrusted destinations, potentially leading to credential harvesting, malware distribution, or confusion about security boundaries. The requirement for user interaction means organizations should focus on user awareness alongside patching. The low-to-medium impact rating suggests this is not a critical infrastructure-level risk, but it warrants prompt remediation to eliminate a plausible attack surface, particularly for organizations where users visit untrusted web content.

Affected systems

Google Chrome is the primary affected product. The vulnerability also affects Chrome installations on supported operating systems: Apple macOS, Linux (via the Linux kernel environment), and Microsoft Windows. Users running Chrome version 149.0.7827.53 or later are protected. The vulnerability does not appear to affect Chromium-based browsers other than Chrome itself based on the CVE scope, though administrators should verify if other Chromium derivatives in their environment require separate updates.

Exploitability

Exploitation is straightforward in execution but requires a user to visit a malicious webpage. An attacker must craft an HTML page that exploits the insufficient policy enforcement—this is a client-side, single-stage attack with no need for prior system access or authentication. The low attack complexity and network accessibility make this suitable for mass distribution via email, advertisements, or compromised legitimate sites. However, the user-interaction requirement (UI:R) significantly reduces the risk compared to a direct browser vulnerability that requires no user action. Successful exploitation results in localized policy bypass rather than system compromise, limiting the scope.

Remediation

Update Google Chrome to version 149.0.7827.53 or later on all affected systems. Chrome's auto-update mechanism should deliver this patch automatically for most users; verify deployment via chrome://help (Settings > About Chrome). For managed environments, use Chrome's enterprise policy update channels or mobile device management (MDM) solutions to enforce patching. No workarounds are available; patching is the only mitigation. Organizations should confirm patch deployment within 2–4 weeks of the stable release date.

Patch guidance

Chrome version 149.0.7827.53 or later contains the fix. Users should enable automatic updates; Chrome on Windows, macOS, and Linux will prompt for restart when an update is available. Enterprise administrators should verify patch deployment via chrome://version or use Chrome OS management console / MDM tools to confirm all endpoints have updated. No additional configuration is required post-patch. Verify the fix is in place by checking the version number in Settings > About Chrome or chrome://version.

Detection guidance

Monitor for Chrome version drift using endpoint detection and response (EDR) tools or mobile device management (MDM) if Chrome is managed. For network-based detection, look for unusual navigation patterns or redirects from internal systems to external C&C-like domains, though this is difficult to distinguish from legitimate traffic without proxies and decryption. User reports of unexpected browser redirects or page navigation should trigger investigation. Logging of Chrome version compliance can be automated via enterprise management tools. No signature-based detection is practical because the vulnerability is in policy enforcement logic, not a binary pattern.

Why prioritize this

This vulnerability merits near-term patching (within 2–4 weeks) due to its low barrier to user exploitation and potential for phishing-oriented attacks, but it is not a drop-everything emergency. The Medium severity, user-interaction requirement, and limited scope (confidentiality, integrity, and availability impacts are each low) place it below critical vulnerabilities. However, its exploitability via social engineering and presence across multiple operating systems means it should not be deprioritized. Organizations with high-security-awareness cultures may prioritize other risks first, but general enterprises should treat this as standard patching priority.

Risk score, explained

The CVSS 3.1 score of 6.3 reflects a Medium-severity vulnerability with several mitigating factors. The network-accessible attack vector (AV:N) and low attack complexity (AC:L) indicate ease of delivery. However, the requirement for user interaction (UI:R) and unchanged scope (S:U) reduce the severity. The low individual impact to confidentiality (C:L), integrity (I:L), and availability (A:L) further constrains the score. This is not a high-severity finding; the score appropriately reflects a phishing-like attack that bypasses browser navigation policy rather than a direct code-execution or authentication bypass flaw.

Frequently asked questions