CVE-2026-11199: Chrome WebRTC Cross-Origin Data Leak Vulnerability

Technical summary

CVE-2026-11199 stems from an inappropriate implementation in Chrome's WebRTC subsystem that fails to properly isolate cross-origin data from malicious network traffic. The vulnerability is classified as CWE-20 (Improper Input Validation), indicating that Chrome's WebRTC component does not adequately validate or filter network-sourced data before exposing it to web content. An attacker with network-level access (AV:N, AC:H) can craft malicious traffic to trigger the flaw and exfiltrate confidential information. The CVSS 3.1 vector (5.9, MEDIUM) reflects high confidentiality impact but no integrity or availability compromise.

Business impact

This vulnerability poses a confidentiality risk primarily to users on untrusted networks—particularly those connecting via public Wi-Fi, compromised corporate networks, or ISP-level attackers in certain regions. Organizations with strict data sensitivity requirements (finance, healthcare, legal) should prioritize patching because users may inadvertently leak session data, authentication tokens, or personal information during video calls or real-time communication sessions. The impact is mitigated by the requirement for attacker network positioning, making this less critical than remote code execution vulnerabilities, but the stealthy nature of network-based attacks means detection and prevention may be challenging.

Affected systems

Google Chrome is the primary affected product and the source of the vulnerability. The vulnerability also affects systems running Chrome on macOS, Linux, and Windows platforms. Users on any operating system running Chrome versions prior to 149.0.7827.53 are at risk. Note that while the vendor list includes the operating systems themselves, the vulnerability resides in the Chrome application; patching Chrome is the primary mitigation.

Exploitability

Exploitation requires an attacker to occupy a privileged network position (e.g., rogue access point, ISP-level position, or compromised network segment). The attacker must craft malicious network traffic that interacts with an active WebRTC session. This is not trivial—the attacker cannot exploit the vulnerability remotely over the open internet from an arbitrary location, and user interaction is not required, which keeps the difficulty moderate. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating no evidence of active in-the-wild exploitation as of the publication date.

Remediation

Users and administrators must upgrade Google Chrome to version 149.0.7827.53 or later. Chrome's auto-update mechanism typically handles this transparently, but users should verify their current version (Chrome menu > About Google Chrome) and restart the browser to complete the update if necessary. Organizations managing Chrome deployments should use group policies or mobile device management (MDM) platforms to enforce the minimum version requirement and prevent rollback to vulnerable versions.

Patch guidance

Verify that Chrome has auto-updated to 149.0.7827.53 or later by navigating to Chrome Settings > About Google Chrome, which will display the current version and check for updates. If an older version is displayed, manually trigger an update and restart the browser. For enterprise deployments, verify that policies enforcing minimum Chrome versions are in place and are being applied to all managed devices. Test WebRTC functionality (video/audio calls, screen sharing) after patching to ensure no regressions in real-time communication features. Consider pushing the update through MDM or WSUS to accelerate coverage across the organization.

Detection guidance

Network-based detection is challenging since the attack operates at the WebRTC protocol layer. Organizations can monitor for suspicious network traffic patterns around WebRTC sessions on untrusted networks, but this requires protocol-aware network monitoring tools. Endpoint detection should focus on verifying Chrome version compliance via asset inventory and configuration management databases. Monitor user reports of unexpected data exposure or unusual activity on video call platforms. Consider using browser isolation or network segmentation to limit user exposure to untrusted networks where such attacks are most feasible.

Why prioritize this

While the CVSS score (5.9, MEDIUM) is moderate, several factors warrant priority attention: (1) Chrome's ubiquity means millions of users are potentially exposed; (2) the vulnerability affects confidentiality of sensitive communications, particularly concerning for users in regulated industries; (3) network-based attacks can be difficult to detect and prevent at the endpoint; (4) the patch is straightforward and carries low deployment risk due to Chrome's mature auto-update infrastructure. Organizations should prioritize patching over the next 1–2 weeks, with higher urgency for users in regulated or high-sensitivity roles.

Risk score, explained

The CVSS 3.1 score of 5.9 reflects a MEDIUM severity. Network accessibility (AV:N) and high confidentiality impact (C:H) drive the score upward, but the requirement for a privileged attacker position (AC:H) and lack of integrity or availability impact moderate the final rating. This is appropriate: the vulnerability is real and affects widespread software, but exploitation barriers (network positioning) and limited scope (information disclosure only) prevent a higher score. Organizations should not dismiss MEDIUM-severity vulnerabilities; this score indicates a material risk that warrants timely patching.

Frequently asked questions