CVE-2026-11210: Chrome Safe Browsing Bypass via Crafted RAR Files

Technical summary

The vulnerability stems from an inappropriate implementation in Chrome's Safe Browsing module, which failed to correctly enforce discretionary access control (DAC) protections when processing RAR archive files. The flaw is tracked under CWE-284 (Improper Access Control) and allows a network-based attacker to circumvent browser-level access restrictions through a crafted RAR payload. User interaction is required—the victim must explicitly open or interact with the malicious file. The issue was patched in Chrome 149.0.7827.53 and higher.

Business impact

Users relying on Chrome's Safe Browsing as a layer of defense against malicious files face reduced protection when handling RAR archives. While the vulnerability requires user action, it could enable data exfiltration or unauthorized system modification if an attacker combines the bypass with secondary exploits. Organizations managing Chrome deployments should prioritize updates to minimize exposure, particularly in environments where users regularly download or exchange archived files.

Affected systems

The vulnerability affects Google Chrome on Windows, macOS, and Linux platforms running versions prior to 149.0.7827.53. All three major operating systems are in scope; the specific OS version requirements depend on Chrome's compatibility matrix for the patched release. Chromium-based browsers derived from affected Chrome versions may also be vulnerable.

Exploitability

Exploitation requires user interaction—specifically, a victim must open a crafted RAR file in or near Chrome. The attack vector is network-based and requires no special privileges or complex conditions beyond social engineering or drive-by download scenarios. The Chromium security team classified this as Medium severity, reflecting the moderate impact (integrity compromise) and the practical user-interaction barrier. No known public exploits have been associated with this CVE as of the publication date.

Remediation

Update Google Chrome to version 149.0.7827.53 or later. Automatic updates are available through Chrome's built-in update mechanism; users should restart the browser to complete patching. For managed environments, system administrators should push the update through their Chrome management infrastructure (e.g., Google Admin Console, Microsoft Intune, or MDM solutions). No workarounds exist; patching is the sole remediation.

Patch guidance

Chrome users should enable automatic updates if not already active (the default configuration). Navigate to Chrome menu > About Google Chrome to check and download the latest version. For enterprise deployments, verify patch status across your fleet using Chrome management tools or endpoint management solutions. Testing the patch in a non-production environment is recommended before enterprise-wide rollout, though the security risk of delaying this update generally outweighs testing delays. Verify the patched version matches or exceeds 149.0.7827.53 before considering devices compliant.

Detection guidance

Monitor Chrome version numbers across your environment using endpoint detection and response (EDR) tools, mobile device management (MDM), or configuration management databases. Flag any Chrome installation below version 149.0.7827.53 as requiring immediate attention. Log analysis is unlikely to reveal exploitation attempts directly, as Safe Browsing bypass events are not typically logged; focus detection efforts on identifying which users or systems have not yet patched. Monitor for unusual RAR file handling or user complaints about unexpected file access warnings.

Why prioritize this

Although classified as Medium severity, this vulnerability merits rapid patching because it directly undermines a key browser security control. Safe Browsing is a frontline defense against malicious downloads; a bypass weakens that defense for a common file format. The low complexity and user-interaction requirement mean opportunistic attackers could combine this flaw with phishing or watering-hole campaigns. Patches are non-disruptive and widely available, making delay unjustifiable.

Risk score, explained

The CVSS 3.1 score of 6.5 (Medium) reflects an integrity-based attack vector (I:H) that requires network access and user interaction but causes no confidentiality or availability impact. The absence of privilege escalation or system compromise limits the score; however, the ability to bypass access controls on files is meaningful in contexts where archived content contains sensitive data or when combined with secondary attack chains. Organizations with elevated concern about data integrity should treat this as a higher-priority patch.

Frequently asked questions