CVE-2026-11195: Chrome MHTML Cross-Origin Data Leak – Patch Now

Technical summary

CVE-2026-11195 is a cross-origin data disclosure vulnerability in Chrome's MHTML implementation. The issue stems from inappropriate handling of MHTML content processing, allowing a network-based attacker to craft HTML pages that trigger unintended information exposure when users engage in specific UI interactions. The vulnerability falls under Origin Policy Violation (CWE-346) and Cross-Site Request Forgery (CWE-352) categories, indicating failures in same-origin policy enforcement and state-changing request validation. The attack requires user interaction and the user must be tricked into visiting a malicious page, but does not require authentication, making it a relatively low-friction exploitation scenario once a user is socially engineered to the attacker's site.

Business impact

This vulnerability creates a data exfiltration risk for any organization whose employees use Chrome to access sensitive cloud applications, internal web portals, or SaaS platforms. An attacker could harvest session tokens, API keys, or sensitive information displayed on pages that users visit while also opening the attacker's malicious page. For enterprises managing confidential workflows (financial systems, healthcare portals, legal databases), the undetected leakage of cross-origin data could result in compliance violations, IP theft, or breach notification obligations. The requirement for user interaction means targeted phishing campaigns or compromised advertising networks are the most likely attack vectors.

Affected systems

All Google Chrome installations on Windows, macOS, and Linux running versions prior to 149.0.7827.53 are vulnerable. Users on supported versions of Chrome that have not yet auto-updated to the fixed release are at risk. Organizations managing Chromebook fleets, enterprise Chrome deployments, or environments where users run local Chrome browsers should prioritize inventory of installed versions. Third-party Chromium-based browsers may also be affected if they do not promptly backport the fix.

Exploitability

Exploitation requires a moderate level of attacker capability: an attacker must craft a convincing phishing email or compromised ad campaign to direct users to a malicious page, then the user must perform specific UI interactions on that page. There is no unauthenticated network exploit or one-click trigger; social engineering is the gating factor. Once user interaction occurs, data leakage is automatic and silent. The vulnerability has not been added to the Known Exploited Vulnerabilities (KEV) catalog, indicating no evidence of in-the-wild exploitation at the time of this analysis, though that status can change. Given its Medium CVSS score (6.5) and the availability of a patch, opportunistic attackers may test it once awareness spreads.

Remediation

Update Google Chrome to version 149.0.7827.53 or later. Users can check their version at chrome://version/ and force an update via Chrome Settings > About Chrome, which will trigger an automatic download and apply the patch on next restart. Enterprise administrators should deploy this update through their standard patch management processes immediately. No workarounds are available short of avoiding untrusted websites or disabling MHTML processing, neither of which is practical; patching is the only reliable remediation.

Patch guidance

Chrome 149.0.7827.53 and all subsequent releases contain the fix for this vulnerability. Users on Chrome 148 or earlier must upgrade. If your organization uses Chrome Enterprise license, verified that automatic updates are enabled or use your management console (Google Admin Console) to push the update to all devices. For Linux distributions that package Chrome, check with your distro's repository for availability of the patched version. Verify remediation by confirming the version string at chrome://version/ shows 149.0.7827.53 or higher.

Detection guidance

Monitor Chrome version inventory across your endpoints using Mobile Device Management (MDM) solutions, intune, or asset management tools to identify systems running pre-149.0.7827.53 builds. At the network level, detection is difficult because MHTML parsing occurs client-side; however, monitoring for suspicious MHTML downloads or unusual cross-origin data flows (if your proxy/DLP supports it) may surface exploit attempts. Consider user awareness training on phishing campaigns that direct to unfamiliar websites requesting interaction. Web proxy logs showing visits to unfamiliar sites followed by rapid queries to sensitive internal systems may indicate exploitation, though attribution is weak. Focus detection efforts on inventory management rather than behavioral detection.

Why prioritize this

Although this vulnerability carries a Medium CVSS score and has not yet entered active exploitation, Chrome is ubiquitous in enterprise environments and the attack vector (social engineering + user interaction) is practical for targeted campaigns. Organizations handling sensitive data (healthcare, finance, legal, technology sectors) should prioritize this patch within their standard 30-day patch cycle. For general enterprises, this is a high-priority patch due to Chrome's popularity and the confidentiality impact, but slightly lower urgency than critical or exploited vulnerabilities. The automatic update mechanism in Chrome reduces friction, so most users will be patched passively if updates are not deliberately delayed.

Risk score, explained

The CVSS 3.1 score of 6.5 (Medium) reflects a network-based attack with low complexity that requires user interaction and results in high confidentiality impact but no integrity or availability impact. The score appropriately captures the balance between ease of exploitation (social engineering) and the severity of the outcome (silent data leakage). This score does not factor in prevalence of Chrome or business context, which may elevate risk for data-sensitive organizations. The absence of KEV status suggests limited or no active exploitation, which may lower immediate operational risk but does not reduce the need to patch.

Frequently asked questions