CVE-2026-11233: Chrome FoldableAPIs Same-Origin Policy Bypass (Medium, 4.7 CVSS)

Technical summary

The vulnerability stems from insufficient policy enforcement in the FoldableAPIs implementation within Chromium. FoldableAPIs are a web standards feature for detecting and responding to foldable device hardware states. The flaw allows an attacker with renderer process compromise to craft HTML that circumvents same-origin policy (SOP) enforcement, potentially enabling cross-origin data access. This is classified as improper input validation (CWE-20). The attack requires user interaction—the user must visit the malicious page—and results in confidentiality impact only; integrity and availability are not affected.

Business impact

For most organizations, the business risk is limited because exploitation requires two conditions: an attacker must first compromise the Chrome renderer process through another vulnerability, and then trick a user into visiting a specially crafted webpage. This is a chaining scenario rather than a direct attack vector. However, in environments where users regularly visit untrusted content or where sophisticated multi-stage attacks are a concern, the ability to bypass same-origin policy increases the cost of renderer compromise by enabling data exfiltration. Confidential data accessible via the user's browser cookies or stored credentials could be at risk.

Affected systems

The vulnerability affects Google Chrome prior to version 149.0.7827.53. While the vendor list includes Apple macOS, Linux Kernel, and Microsoft Windows, these are the operating systems Chrome runs on; the vulnerability is specific to Chrome itself and its FoldableAPIs implementation. Any organization deploying Chrome—particularly on managed devices or in security-sensitive roles—should assess their Chrome version inventory. Mobile Chrome versions derived from the same Chromium codebase may also be affected; verify the specific version status from Google's security advisories.

Exploitability

Exploitability is rated as moderate but requires a prerequisite attack. The CVSS vector reflects that network access and no special privileges are needed, but user interaction is required and the attack scope extends beyond the vulnerable component. Critically, an attacker must have already compromised the renderer process through an unrelated vulnerability. The barrier to exploitation is therefore two-fold: first gaining renderer access, then luring a user to the malicious page. Public exploit code is not known to exist. The vulnerability is not on the CISA Known Exploited Vulnerabilities list.

Remediation

Update Google Chrome to version 149.0.7827.53 or later. This is a straightforward patch that addresses the policy enforcement gap in FoldableAPIs. Chrome's auto-update mechanism should deliver this patch automatically; verify completion by checking Chrome's About page (chrome://about) to confirm the active version. Organizations managing Chrome fleet-wide should push this update through their standard software deployment channels and confirm adoption across endpoints before deprioritizing.

Patch guidance

For desktop Chrome: Enable automatic updates (the default) and allow the browser to restart, or manually navigate to chrome://settings/help to check for and apply updates immediately. For managed Chrome deployments, use your device management solution (e.g., Google Admin Console, Intune, or third-party MDM) to push version 149.0.7827.53 or later. For Chrome OS devices, patching is automatic and requires no administrator intervention. Test the patch in a small pilot group before fleet-wide deployment if your change management policy requires it, though this is a straightforward security update with minimal regression risk.

Detection guidance

Monitor Chrome version inventory across your organization using endpoint management tools or browser telemetry. Chrome auto-update should reduce the window of vulnerability, but verify actual version adoption rather than relying on deployment signals alone. Detection of active exploitation is challenging without renderer crash logs or network-based behavioral analysis; focus on version compliance as the primary control. If you operate a web service, consider monitoring for unusual cross-origin access patterns or anomalous cookie access from your security event logs, though this would only be visible if exploitation occurs against your specific domain. Network-based detection is not practical for this vulnerability.

Why prioritize this

While the CVSS score is 4.7 (Medium), the practical risk is lower due to the prerequisite renderer compromise requirement. Prioritize this as a standard security update rather than a critical emergency patch. Organizations running Chrome should patch within their standard update cycles (typically 2–4 weeks). However, if your organization is actively defending against targeted attacks or operates high-value targets, prioritize this patch sooner to reduce the attack surface available to sophisticated adversaries who have already achieved renderer compromise.

Risk score, explained

The CVSS 3.1 score of 4.7 reflects a Medium severity rating. The score is driven by network accessibility (AV:N), low attack complexity (AC:L), and no privilege requirement (PR:N), but is tempered by the requirement for user interaction (UI:R) and changed scope (S:C), combined with only confidentiality impact (C:L) and no integrity or availability impact (I:N, A:N). This is a reasonable assessment given that exploitation requires pre-existing renderer compromise. The score does not capture the prerequisite nature of the attack; organizations should not over-weight this number without considering the two-stage attack requirement.

Frequently asked questions