CVE-2026-11197: Chrome Same-Origin Policy Bypass in Workers – Patch v149.0.7827.53

Technical summary

CVE-2026-11197 is a same-origin policy bypass in Chrome Workers caused by insufficient policy enforcement. The vulnerability exists in the Worker implementation prior to version 149.0.7827.53. An attacker with renderer process control can supply a crafted HTML page that causes Workers to execute fetch or XMLHttpRequest operations against origins they should be restricted from accessing. The root cause maps to CWE-284 (Improper Access Control), indicating a logic flaw in the Worker's permission-checking mechanism rather than a memory corruption issue.

Business impact

The practical impact depends on your threat model. If your organization uses Chrome for accessing sensitive internal web applications or SaaS platforms, a compromised renderer—whether via malware, a separate browser exploit, or social engineering—could be leveraged to exfiltrate data from other sites the user is logged into. For most users, this requires a prior compromise; it is not a direct entry point. However, when chained with other renderer exploits, it increases the blast radius of a browser compromise.

Affected systems

Google Chrome prior to version 149.0.7827.53 is affected. The vulnerability also affects the operating systems on which Chrome runs: Windows, macOS, and Linux. The listing includes the Linux kernel as an affected product, likely indicating that the vulnerability may impact Chromium derivatives and web browsers built on Chromium (such as Brave, Edge, or Opera) depending on their version synchronization with upstream Chrome.

Exploitability

Exploitation requires two preconditions: (1) the attacker must first compromise the renderer process, and (2) the user must interact with a crafted webpage (UI interaction required). This two-stage requirement limits opportunistic attacks. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) reflects network accessibility and low attack complexity once the renderer is compromised, but the prerequisite compromise is not trivial. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog, suggesting no active weaponization has been observed or disclosed as of the publication date.

Remediation

Update Google Chrome to version 149.0.7827.53 or later. This patch hardens policy enforcement in the Worker implementation to prevent the bypass. Users on Windows, macOS, and Linux should prioritize this update. For organizations using Chromium-based browsers (Edge, Brave, Opera, etc.), verify that your browser vendor has released a corresponding patch and apply it on the same timeline.

Patch guidance

Chrome updates can be applied through Settings > About Chrome, which will automatically check for and install the latest version. For enterprise environments using managed Chrome installations, push version 149.0.7827.53 or later through your MDM/patch management system. If you use Chromium forks, cross-reference the upstream Chrome release notes to determine the equivalent patched version for your browser and deploy accordingly. Verify patch installation by navigating to chrome://version and confirming the version number matches or exceeds 149.0.7827.53.

Detection guidance

Detection is challenging because the attack requires prior renderer compromise and execution of crafted JavaScript in a Worker context. Monitor for unusual Worker creation patterns, especially those attempting cross-origin fetch operations. Security analytics platforms that inspect Chrome DevTools Protocol (CDP) traffic or JavaScript execution logs may flag Worker scripts making requests to unexpected domains. At the host level, monitor for secondary indicators: unusual browser process behavior, unexpected outbound connections, or privilege escalation attempts following a browser crash or suspicious tab load. Web application firewalls (WAFs) can log anomalous same-origin requests, but this requires detailed request logging.

Why prioritize this

Prioritize this update for users and systems where Chrome is the primary browser for accessing sensitive web applications or where the user handles credentials for multiple services. The Medium CVSS score (6.5) and requirement for prior renderer compromise lower the urgency compared to critical remote code execution flaws, but the ease of attack post-compromise (AC:L) and the high integrity impact (I:H) warrant quick deployment. Organizations with high-value targets (finance, healthcare, government) or those in sectors with active browser-targeted campaigns should patch within 1–2 weeks. General enterprise deployments can target 3–4 weeks.

Risk score, explained

The CVSS 3.1 score of 6.5 (Medium) reflects a network-accessible flaw with low attack complexity that causes high integrity impact (data exfiltration via cross-origin bypass) but requires user interaction and a prior renderer compromise. The lack of confidentiality impact (C:N) is correct because the Worker does not gain new data-reading capabilities; it gains the ability to write or send data where it should not. The unchanged scope (S:U) indicates the impact is limited to the Chrome process and the websites it accesses. This score appropriately situates the vulnerability as serious but not critical—it is a privilege escalation within a compromised browser, not a remote code execution vector.

Frequently asked questions