CVE-2026-11212: Chrome DevTools Cross-Origin Data Leak via Malicious Extension

Technical summary

CVE-2026-11212 describes insufficient policy enforcement in Chrome's DevTools component, classified as a cross-origin data leak vulnerability (CWE-284: Improper Access Control). The flaw allows a malicious extension to bypass security boundaries and access data from origins other than its own. The vulnerability requires user interaction—specifically, convincing a user to install the malicious extension—but does not require elevated privileges. Once installed, the extension can leverage the DevTools policy gap to exfiltrate cross-origin data. The Chromium project rated this as Medium severity.

Business impact

This vulnerability primarily affects user confidentiality. Organizations with Chrome-dependent workflows face risk if employees install untrusted extensions, potentially exposing customer data, authentication tokens, or proprietary information viewed in the browser. The attack requires social engineering to distribute the malicious extension, making organizations with strong extension governance policies less vulnerable. However, users who bypass policy controls or operate in BYOD environments remain at risk.

Affected systems

Google Chrome prior to version 149.0.7827.53 is directly affected. The vulnerability also affects Chrome running on macOS, Linux, and Windows, so all major operating systems running vulnerable Chrome releases are in scope. Organizations should inventory Chrome deployments and verify patch status across all endpoints, regardless of OS.

Exploitability

Exploitation requires user interaction—specifically convincing a user to install a malicious extension. There is no network-based attack vector or exploit requiring zero-click execution. The attack surface is limited to users who either explicitly approve extension installation or operate in environments with weak extension controls. Social engineering, phishing, or masquerading as a legitimate tool would be typical attack vectors. CVSS 4.3 reflects this moderate barrier to exploitation combined with confidentiality impact.

Remediation

Update Google Chrome to version 149.0.7827.53 or later. Organizations should enforce Chrome auto-update policies to minimize the window of vulnerability. Additionally, implement extension governance policies that restrict installation to approved, vetted extensions from trusted developers. Security teams should review any existing extension deployments and remove or disable suspicious or unnecessary extensions.

Patch guidance

Chrome auto-updates can be configured at the enterprise level via group policy (Windows), configuration profiles (macOS), or Linux policy mechanisms. Verify deployment across managed endpoints to confirm all instances have reached version 149.0.7827.53 or later. If auto-update is disabled for operational reasons, prioritize this update. Test in a limited environment first if your organization has custom extensions that may be affected by the policy enforcement change.

Detection guidance

Monitor for unexpected extension installations, particularly outside of managed app deployment processes. Review Chrome extension logs for extensions requesting excessive cross-origin permissions or installed from untrusted sources. Endpoint detection and response (EDR) tools can flag suspicious extension behavior. Additionally, check browser console logs and DevTools activity for unusual data exfiltration patterns. Extension marketplace reviews and user reports of unexpected data access may surface active exploitation.

Why prioritize this

While the CVSS score is moderate (4.3), the vulnerability warrants timely patching because it enables confidentiality breaches through a commonly exploited attack vector: malicious extensions. Organizations relying on Chrome for handling sensitive data should prioritize this update. The lack of active exploitation in the wild (no KEV status) provides a window to patch proactively before attackers mature campaigns.

Risk score, explained

CVSS 4.3 (Medium) reflects a low-complexity network attack requiring user interaction and resulting in confidentiality loss only—no integrity or availability impact. The vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N captures that the attack is network-reachable, requires no privileges, but does need the user to install the extension. The lack of scope change (S:U) and limited impact (C:L only) keep the score below 5.0, but the confidentiality risk in multi-user or high-data-exposure environments justifies not dismissing this as low-priority.

Frequently asked questions