CVE-2026-11187: Chrome Navigation Restriction Bypass Vulnerability

Technical summary

CVE-2026-11187 stems from an inappropriate implementation in Chrome's Glic component, classified under CWE-284 (Improper Access Control). The vulnerability permits navigation restriction bypass through a crafted HTML page, without requiring elevated privileges. The attack vector is network-based, the attack complexity is low, and user interaction is required. The vulnerability affects confidentiality, integrity, and availability equally. Chrome security classified this as Medium severity, reflected in a CVSS 3.1 score of 6.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L).

Business impact

This vulnerability could allow attackers to circumvent browser-based navigation controls, potentially exposing users to unintended destinations or restricted content. For organizations relying on Chrome's security features to enforce access policies or prevent users from accessing certain sites, this creates a compliance and risk management gap. The need for user interaction limits mass exploitation, but targeted campaigns against high-value users remain feasible. Remediation is straightforward via patching, but any delay leaves users exposed to social engineering and forced-navigation attacks.

Affected systems

Google Chrome on Windows, macOS, and Linux is the primary affected platform. The vulnerability applies to all Chrome installations running version 149.0.7827.52 and earlier. Organizations should inventory Chrome deployments, particularly those in security-sensitive roles or managing restrictive navigation policies. While Chromium-based browsers (Edge, Brave, etc.) may inherit risk depending on their release cadence, the source data explicitly identifies Chrome, Windows, macOS, and Linux kernel as affected vendors/products.

Exploitability

Exploitation requires crafting a malicious HTML page and convincing or tricking a user into visiting it—no special attack infrastructure or zero-day techniques are needed. The low attack complexity and lack of authentication requirements make this straightforward for an attacker to attempt. However, the mandatory user interaction (clicking a link, visiting a site) provides a natural friction point; mass exploitation is less likely than targeted spear-phishing or drive-by-download scenarios. The vulnerability is not currently tracked on the CISA Known Exploited Vulnerabilities (KEV) catalog, suggesting active exploitation has not yet been widespread or documented at scale.

Remediation

Update Google Chrome to version 149.0.7827.53 or later on all supported platforms. This patch addresses the Glic implementation flaw and restores proper navigation restriction enforcement. Verify the update is deployed across your organization's Chrome fleet, particularly on devices with elevated risk exposure. For enterprises managing Chrome via Mobile Device Management (MDM) or group policy, ensure automatic updates are enabled or push the patch proactively. No workarounds exist; patching is the only remediation.

Patch guidance

Google has released Chrome 149.0.7827.53 to resolve this issue. Users should enable automatic updates to receive the patch immediately; administrators can verify deployment by checking Chrome's About page (chrome://about). On Windows, Mac, and Linux, the update process is identical. For managed deployments, verify the rollout using your endpoint management solution to confirm all instances have reached the patched version. No additional configuration changes are required post-patch.

Detection guidance

Monitor for Chrome instances below version 149.0.7827.53 in your asset inventory. Endpoint Detection and Response (EDR) and Mobile Device Management (MDM) tools can query installed Chrome versions and flag out-of-date instances. Network-level detection is limited since the attack uses a crafted HTML page (legitimate-looking traffic), but behavioral monitoring for unexpected navigation or access to restricted URLs may provide early warning. Log Chrome version updates to track patch compliance over time. No specific ICS/IOCS are available for this vulnerability's exploitation payload.

Why prioritize this

While the CVSS score of 6.3 is moderate and the vulnerability is not actively exploited at scale, the low barrier to exploitation and the broad user base affected by Chrome make this a priority for rapid patching. Navigation restriction bypass could enable credential harvesting, malware delivery, or access to restricted resources. Organizations with strict content filtering or access control policies should prioritize this above lower-severity issues. The patch is mature and carries no known compatibility risks, making deployment low-risk and high-benefit.

Risk score, explained

The CVSS 3.1 score of 6.3 reflects the moderate nature of the vulnerability: network attack vector, low complexity, no authentication requirement, and user interaction required. The impact on confidentiality, integrity, and availability is limited (partial, not complete), and the scope is unchanged. This score appropriately captures the risk of navigation bypass without overstating it as critical. Real-world risk varies by organizational context—entities with strong navigation policies and high-value user populations face greater risk.

Frequently asked questions