CVE-2026-11186: Chrome UXSS Vulnerability in CSS Rendering—Urgent Patch Required

Technical summary

CVE-2026-11186 is a Universal Cross-Site Scripting (UXSS) vulnerability stemming from improper CSS implementation in Google Chrome's rendering engine. The vulnerability allows arbitrary HTML and JavaScript injection via a crafted HTML page, violating the same-origin policy that normally prevents scripts from one domain from accessing resources on another domain. The attack requires no special privileges and triggers through normal user interaction (visiting a malicious page), making it a network-based threat with broad reach. Chromium rated this as Medium severity due to the requirement for user interaction and limited impact scope, though UXSS vulnerabilities are inherently serious as they bypass fundamental browser security models.

Business impact

This vulnerability creates risk for any organization whose employees use Chrome to access cloud applications, internal web portals, or sensitive online services. A successful exploitation could allow attackers to steal session cookies, capture login credentials, exfiltrate data from authenticated sessions, or perform actions on behalf of the user across multiple websites. For organizations relying on web-based tools for critical workflows, compromise of Chrome could mean unauthorized access to email, collaboration platforms, financial systems, or customer data. The attack requires minimal attacker sophistication beyond hosting a malicious webpage, making this a practical threat for targeted campaigns or drive-by compromises.

Affected systems

Google Chrome prior to version 149.0.7827.53 is directly affected. Chrome runs on multiple operating systems including Windows, macOS, and Linux, so the vulnerability impacts users across all three platforms. The underlying rendering engine (Chromium) affects not only Chrome but also Chromium-based browsers, though the vulnerability is tracked specifically against Google Chrome. Users running older or unpatched versions of Chrome remain at risk until they update.

Exploitability

The vulnerability has a low barrier to exploitation. An attacker needs only to craft a malicious HTML page and trick a user into visiting it—no complex interaction or special browser configuration is required. The CVSS score of 6.1 reflects this accessibility; the attack vector is network-based, access complexity is low, and only user interaction is required. However, the vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities (KEV) catalog, suggesting no widespread active exploitation has been publicly documented or reported to federal authorities at this time. Organizations should not assume this means the vulnerability is less important—UXSS flaws are attractive to sophisticated threat actors, and exploitation may occur without public disclosure.

Remediation

Update Google Chrome to version 149.0.7827.53 or later immediately. Chrome's auto-update mechanism typically deploys new versions automatically, but users should verify they are running the latest version by checking Settings > About Chrome. Organizations should verify patch deployment across managed endpoints using their mobile device management (MDM) or endpoint management solutions. No workarounds exist for this vulnerability; patching is the only reliable mitigation.

Patch guidance

Google Chrome typically releases security updates automatically, but administrators should not rely solely on automatic updates in managed environments. Verify that all Chrome installations are running version 149.0.7827.53 or later. For macOS deployments, ensure the update is distributed via your Mac management system. On Windows, use Group Policy or third-party deployment tools to confirm patch status. On Linux systems, ensure Chrome is updated through your distribution's package manager or Google's repository. Test patch deployment in a non-production environment first to confirm no compatibility issues arise with internal web applications.

Detection guidance

Monitor Chrome version telemetry across your fleet using your MDM or endpoint detection and response (EDR) tool to identify unpatched instances. Network-based detection of exploitation attempts is difficult because attacks occur within the browser rendering context and do not generate obvious network signatures. Consider deploying browser isolation technology or sandboxed browsing for high-risk users accessing untrusted websites. Web application firewalls (WAF) cannot block this vulnerability at the network level since it relies on CSS parsing within the browser. Focus detection efforts on identifying unpatched Chrome versions rather than attempting to detect exploitation after the fact.

Why prioritize this

Although this vulnerability carries a Medium CVSS score and is not yet on the KEV list, it warrants urgent patching because UXSS flaws undermine browser security architecture itself. Unlike application-level XSS vulnerabilities that affect only a single website, UXSS can compromise user authentication and data across multiple domains simultaneously. The attack is simple to execute, requires no prior knowledge of target systems, and affects a ubiquitous application (Chrome). Organizations should prioritize this patch to close the window before active exploitation becomes widespread.

Risk score, explained

The CVSS 3.1 score of 6.1 (Medium) reflects a network-accessible attack with low complexity that requires user interaction and causes limited confidentiality and integrity impact without availability impact. The score appropriately accounts for the requirement that a user must visit a malicious page, but understates the practical severity of UXSS threats because CVSS does not fully capture the cross-domain nature of the vulnerability. Security teams should treat this as higher priority than the base score alone suggests.

Frequently asked questions