CVE-2026-11190: Google Chrome Extension Access Control Bypass (6.5 CVSS)

Technical summary

CVE-2026-11190 stems from an inappropriate implementation of access control mechanisms in Chrome's extension framework (CWE-284: Improper Access Control). The vulnerability allows a crafted extension to circumvent discretionary access control (DAC) checks that normally restrict what an extension can do. The root cause lies in the extension validation or permission-enforcement logic prior to Chrome 149.0.7827.53. An attacker-controlled extension can exploit this gap to access protected resources or perform restricted operations that would normally be denied by Chrome's sandbox and permission model. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) indicates network accessibility with low attack complexity, user interaction required, and high integrity impact with no confidentiality or availability loss—consistent with an extension bypassing intended restrictions.

Business impact

If exploited, this vulnerability enables extensions to modify browser behavior, settings, or user data beyond their declared permissions. For enterprises, this could allow unauthorized extensions (whether distributed through social engineering or compromised supply chains) to alter security policies, intercept or modify web traffic, inject malicious content, or extract sensitive data from browsing sessions. The integrity impact is significant: users may not realize their browser environment has been compromised, leading to potential data exfiltration, credential theft, or deployment of secondary malware. The user-interaction requirement limits blast radius to individuals who install the extension, but once installed, the bypass is complete.

Affected systems

All platforms running Chrome prior to version 149.0.7827.53 are affected, including Windows, macOS, and Linux systems. The vulnerability is specific to the Chrome browser and does not directly affect the underlying operating systems (Windows, macOS, Linux) beyond the Chrome process itself. Users on these platforms who rely on Chrome for work should prioritize patching. The risk is user-centric rather than OS-centric: any user with Chrome installed and the ability to install extensions is a potential target.

Exploitability

Exploiting this vulnerability requires social engineering or distribution of a malicious extension through deceptive means. An attacker must convince a user to install a crafted extension from the Chrome Web Store, a third-party repository, or a direct link. The attack complexity is low once the extension is installed, but the prerequisite user interaction (installation consent) is a necessary friction point. There is no evidence of in-the-wild exploitation at publication, and the vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the low technical barrier to weaponization and the high impact make this a plausible target for targeted campaigns against specific users or organizations.

Remediation

Update Google Chrome to version 149.0.7827.53 or later. Chrome typically auto-updates, but users and administrators should verify their version via Settings > About Google Chrome and force an update if necessary. For enterprise environments, use Chrome policies to enforce automatic updates and restrict extension installation to a managed allowlist via the ExtensionInstallWhitelist or ExtensionInstallForcelist policies. Audit installed extensions for suspicious or unnecessary additions, and educate users on the risks of installing extensions from untrusted sources. Consider restricting extension permissions via the ExtensionSettings policy.

Patch guidance

Verify your Chrome version by navigating to chrome://settings/help. If the version is lower than 149.0.7827.53, restart Chrome to apply any pending updates. For manual confirmation, check the version string in Settings > About Google Chrome; the browser will auto-check for updates and display the latest available version. Enterprise administrators should confirm patch deployment via Chrome management console or policy enforcement reports. No data loss is expected during the update. Rollback is not required; the update is forward-compatible.

Detection guidance

Monitor for suspicious extension installations using Chrome policy reports (if available in your environment) or endpoint detection tools that track browser extension registries. Look for extensions with broad or unusual permissions (e.g., access to all sites, ability to modify settings) from unknown publishers. If available, audit the Chrome user profile directories for unexpected extensions. Behavioral detection should flag attempts to modify security settings or permissions unexpectedly. On managed devices, track failed or unusual extension installation attempts. Note that the vulnerability itself leaves no obvious forensic artifacts beyond the presence of the malicious extension; detection relies primarily on identifying the extension itself and its behavior.

Why prioritize this

This vulnerability merits medium-to-high priority for patching due to its integrity impact, ease of distribution via social engineering, and applicability to all Chrome users. While user interaction is required, the bypass of access controls is complete once the extension is installed. Organizations with strict bring-your-own-device (BYOD) policies or those concerned about supply-chain attacks on extensions should prioritize this patch. The CVSS 6.5 and Chromium medium severity classification reflect the real-world risk, though the attack surface is limited to users who can be tricked into installing extensions. Patch promptly but not urgently; regular update cadence is sufficient for most organizations absent targeted threat intelligence.

Risk score, explained

The CVSS 3.1 score of 6.5 (Medium) is driven by high integrity impact (I:H), indicating the ability to modify or alter Chrome functionality without authorization. Network accessibility (AV:N) and low attack complexity (AC:L) reflect that exploitation is straightforward once the extension is obtained. The user interaction requirement (UI:R) and the scope remaining unchanged (S:U) mean the impact does not escalate beyond the affected user's browser session. Chromium's own Medium severity rating aligns with this assessment. No confidentiality or availability loss is indicated, limiting the score. For businesses handling sensitive data, the integrity impact alone justifies rapid patching.

Frequently asked questions