CVE-2026-11192: Chrome Password Manager UI Spoofing Vulnerability (CVSS 4.3)

Technical summary

CVE-2026-11192 is an input validation vulnerability (CWE-20) in the Password Manager component of Google Chrome prior to version 149.0.7827.53. The flaw allows insufficient validation of untrusted input received via network traffic, enabling UI spoofing attacks. An unauthenticated remote attacker with network access can craft malicious traffic to trigger the vulnerability. The CVSS 3.1 score of 4.3 (Medium severity) reflects low attack complexity and no special privileges required, but limited impact—the attack affects integrity only (UI manipulation) with no confidentiality or availability impact. This is a network-based attack requiring user interaction.

Business impact

While rated Medium severity, this vulnerability poses a meaningful phishing and social engineering risk. Attackers could spoof password entry dialogs, two-factor authentication prompts, or security warnings to harvest credentials. The attack requires user interaction and a network position to inject malicious traffic, limiting opportunistic mass exploitation but creating targeted risk for users on compromised networks (corporate, public WiFi, ISP-level attacks). Organizations relying on Chrome for workforce browsers should prioritize patching to reduce credential compromise risk, particularly if employees use public networks.

Affected systems

The vulnerability affects Google Chrome on all major operating systems: Windows, macOS, and Linux. Any Chrome installation prior to version 149.0.7827.53 is vulnerable. The listed affected vendors/products (Google Chrome, Apple macOS, Linux kernel, Microsoft Windows) indicate the scope includes Chrome deployments across these platforms. Enterprise environments with mixed OS deployments must patch Chrome on all endpoints.

Exploitability

Exploitability is rated as straightforward (CVSS AV:N, AC:L, PR:N). An attacker requires only network access and user interaction—they must position themselves to intercept or manipulate network traffic (e.g., via compromised WiFi, BGP hijacking, DNS spoofing, or ISP compromise) and then craft malicious traffic that triggers the password manager's UI spoofing. The attack is not in the CISA KEV catalog, suggesting active exploitation in the wild has not been widely documented as of the publication date. However, the low technical barrier and practical value for phishing make it a realistic post-patch risk.

Remediation

Update Google Chrome to version 149.0.7827.53 or later. Chrome's auto-update mechanism will deliver patches automatically for most users, but verify deployment in managed environments. No workarounds exist; patching is the only mitigation. Organizations should confirm patch deployment across all Chrome instances, including managed deployments via Mobile Device Management (MDM), Group Policy, or endpoint management tools.

Patch guidance

Install Chrome version 149.0.7827.53 or later. For enterprise deployments: verify Chrome auto-update is enabled or use centralized update mechanisms (Google Admin Console for Workspace users, Windows Group Policy for corporate Windows environments, or MDM solutions for macOS and Linux). Test patches in a controlled environment first if your organization maintains custom Chrome policies. Check Chrome's release notes and security advisories at https://chromereleases.googleblog.com/ to confirm patch availability and rollout status. Verify endpoint compliance post-patching.

Detection guidance

Detection is challenging because the attack exploits client-side UI rendering without necessarily leaving obvious network signatures. However, organizations can: (1) monitor network traffic for anomalies on ports used by Chrome (DNS, HTTP/HTTPS) that might indicate traffic interception or injection; (2) review endpoint logs for Chrome process behavior, though spoofing attacks may not trigger crash reports; (3) educate users to scrutinize password manager prompts—legitimate Chrome password managers display consistently styled dialogs without external network requests visible to users; (4) deploy network segmentation and encrypted DNS (DoH) to reduce the likelihood of traffic interception; (5) monitor for suspicious login patterns (failed logins followed by success from a new device/location immediately after user reports seeing unusual login prompts) that may indicate credential compromise via spoofing.

Why prioritize this

This vulnerability merits prompt but not emergency patching. Medium CVSS severity, limited impact scope (UI integrity only), and lack of KEV listing suggest it is not actively exploited at scale. However, prioritize patching if: (1) your organization operates in a high-risk network environment (corporate networks, public WiFi-heavy workforce, regions with ISP-level filtering); (2) users handle sensitive credentials via Chrome password manager; (3) your organization manages Chrome centrally and can quickly validate and deploy patches. Standard patch cycles (weekly or monthly) are acceptable if users are educated to be suspicious of unusual password manager prompts.

Risk score, explained

The CVSS 3.1 score of 4.3 reflects: Attack Vector Network (attacker needs no physical access), Attack Complexity Low (straightforward to exploit once positioned), Privileges Required None (no authentication needed), User Interaction Required (user must interact with the spoofed UI), Scope Unchanged (impact limited to the vulnerable component), Confidentiality None (data not disclosed), Integrity Low (UI can be manipulated), Availability None (no denial of service). The Medium severity is appropriate—realistic attackers can exploit this via network positioning and social engineering, but the impact is credential theft through deception rather than direct system compromise. The attack requires both network capability and user action, preventing trivial mass exploitation.

Frequently asked questions