CVE-2026-11200: Chrome WebRTC Cross-Origin Data Leakage Vulnerability

Technical summary

CVE-2026-11200 is a cross-origin data leakage vulnerability in Chrome's WebRTC subsystem stemming from improper implementation of the WebRTC specification. The flaw maps to CWE-346 (Origin Validation Error) and CWE-352 (Cross-Site Request Forgery), indicating that the browser fails to properly validate the origin of WebRTC communications or enforce adequate isolation boundaries. An attacker can craft a malicious HTML page that, when visited by a victim, exploits WebRTC's peer-connection establishment process to exfiltrate session data, authentication tokens, or other sensitive cross-origin content. The attack requires user interaction (visiting the malicious page) but does not require the victim to have any special system privileges or advanced browser configuration.

Business impact

Successful exploitation could result in the theft of user session credentials, authentication cookies, or sensitive cross-origin data accessed through compromised websites. For organizations where employees use Chrome to access internal or sensitive cloud applications, this vulnerability creates a risk of credential theft and unauthorized data access. An attacker could potentially impersonate a victim or access private information that was intended to remain within a single origin, leading to potential compliance violations, account takeover, or data exfiltration incidents.

Affected systems

This vulnerability affects Google Chrome prior to version 149.0.7827.53. Because Chrome runs on Windows, macOS, and Linux, all users on those platforms running unpatched Chrome versions are at risk. The vulnerability is not specific to any particular Chrome extension, plugin, or configuration—it is present in the core WebRTC implementation and affects all users equally.

Exploitability

Exploitability is straightforward: an attacker must craft a malicious HTML page and distribute it through social engineering, phishing, or ad networks to lure users into visiting it. Once a user clicks on the link or is redirected to the page, the JavaScript payload automatically triggers the WebRTC data leakage without additional user interaction beyond the initial visit. No authentication bypass or system compromise is needed. The CVSS score of 6.5 reflects the high confidentiality impact (C:H) tempered by the requirement for user interaction and the fact that it does not enable code execution or system availability attacks.

Remediation

Organizations should prioritize patching Google Chrome to version 149.0.7827.53 or later across all endpoints. For users who cannot immediately update, temporary mitigations include disabling WebRTC in Chrome (via chrome://flags search for 'WebRTC' settings) or using browser extensions that block or restrict WebRTC, though these are not long-term solutions. Verify the patch version against Google's official Chrome release notes to ensure correct deployment.

Patch guidance

Update Google Chrome to version 149.0.7827.53 or later. Google rolls out updates automatically on most platforms, but users should manually check Help > About Google Chrome (or the equivalent on their OS) to force an immediate update check if their systems have not yet received the patch. Enterprise administrators managing Chrome through Group Policy (Windows) or configuration profiles (macOS) should deploy version 149.0.7827.53 or later to their Chrome managed devices. Verify patch deployment by checking chrome://version in the browser to confirm the installed version matches or exceeds the patched version.

Detection guidance

Monitor for WebRTC-related exploitation attempts by checking network logs for unusual peer-to-peer connections originating from the Chrome process, particularly those directed to external or unexpected IP addresses. Endpoint detection and response (EDR) tools should alert on Chrome process spawning suspicious JavaScript execution or attempting to exfiltrate sensitive data. Web proxy logs may reveal visits to known malicious HTML pages designed to exploit this vulnerability. Additionally, monitor Chrome update compliance through your patch management or mobile device management (MDM) system to ensure all instances are running version 149.0.7827.53 or later.

Why prioritize this

Although the CVSS score is 6.5 (Medium), the attack vector is network-based, requires minimal user interaction, and has high confidentiality impact. The vulnerability directly threatens user session security and cross-origin data protection—fundamental trust boundaries in web security. Because Chrome is ubiquitous in enterprise and consumer environments, and the patch is readily available and straightforward to deploy, rapid patching should be a priority to close a window of exposure that could be actively exploited via phishing campaigns targeting your users.

Risk score, explained

The CVSS 3.1 score of 6.5 is driven by a network attack vector (AV:N), low attack complexity (AC:L), no privileges required (PR:N), and required user interaction (UI:R). The high confidentiality impact (C:H) reflects the ability to leak sensitive cross-origin data, while integrity (I:N) and availability (A:N) remain unaffected because the flaw does not allow the attacker to modify data or crash the browser. The score appropriately reflects a serious but remediable data confidentiality risk that does not allow code execution or system compromise.

Frequently asked questions