CVE-2026-11266: Chrome Safe Browsing Bypass Vulnerability — Patch v149.0.7827.53

Technical summary

CVE-2026-11266 stems from an inappropriate implementation in Chrome's Safe Browsing module. The vulnerability exists in how the browser validates and processes files before applying Safe Browsing checks. The flaw allows an attacker to craft a file that evades Safe Browsing's detection logic without requiring elevated privileges or special system-level access. The issue is classified under CWE-693 (Protection Mechanism Failure), indicating a weakness in how the protective mechanism itself is designed or applied. While Chromium's security team rated this as Low severity internally, the CVSS v3.1 score reflects a MEDIUM severity with an integrity impact, meaning the attack compromises the integrity of the user's browsing safety posture.

Business impact

This vulnerability reduces the effectiveness of Chrome's safety mechanisms, which many organizations and users rely on to prevent phishing, malware, and other web-based threats. For business users, a bypass could result in accidental visits to malicious sites, credential theft, or malware installation if combined with social engineering. The integrity impact (rather than confidentiality or availability) means the core function of Safe Browsing—blocking dangerous content—becomes unreliable for affected users. Enterprise environments using Chrome as a standard browser should prioritize updates to maintain consistent endpoint protection.

Affected systems

The vulnerability affects Google Chrome on Windows, macOS, and Linux systems running versions prior to 149.0.7827.53. While the CVE data lists the underlying operating systems (Windows, macOS, Linux kernel) as vendors/products, the actual vulnerability is in the Chrome browser itself; systems are affected only if Chrome is installed and in use. Other Chromium-based browsers may also be affected if they have not ported the fix, though this CVE specifically references Google Chrome.

Exploitability

The attack requires user interaction (opening or interacting with a malicious file), which is reflected in the CVSS vector's UI:R parameter. An attacker would need to socially engineer a user into opening a crafted file, reducing the likelihood of large-scale automated attacks. However, the attack vector is network-based (AV:N), meaning the malicious file can be delivered remotely via email, web downloads, or file-sharing services. The low attack complexity (AC:L) suggests the attacker does not need to know specific system details or timing; the bypass should work reliably once the file is opened.

Remediation

Users and administrators should update Google Chrome to version 149.0.7827.53 or later. This update includes the fix for the Safe Browsing implementation flaw. Updates can be applied automatically if auto-update is enabled, or manually via Chrome's settings menu (menu > Help > About Google Chrome). For enterprises, deployment should prioritize endpoints that process untrusted files or permit external file downloads.

Patch guidance

Verify that your Chrome installation is running version 149.0.7827.53 or later by navigating to menu > Help > About Google Chrome. The browser will automatically attempt to check for and download available updates; after the update is applied and the browser is restarted, the vulnerability will be patched. If auto-updates are disabled in your environment, manually trigger the update check or use your organization's software deployment tools to push the patched version. Test Safe Browsing functionality after patching to ensure no unexpected behavior.

Detection guidance

Monitor Chrome version information across your endpoints to identify instances running pre-149.0.7827.53 releases. Endpoint detection and response (EDR) tools may flag suspicious file delivery or processing attempts, though the vulnerability itself does not require special behavioral signatures. Check browser telemetry logs for Safe Browsing warnings that were bypassed or suppressed. If you suspect exploitation, review user browsing history and downloaded files around the time of potential attack vectors.

Why prioritize this

While the CVSS score is MEDIUM and the Chromium team rated it Low severity, this vulnerability directly undermines a key user-facing security control. Prioritize patching in environments where users frequently download or receive files from external sources, and where Safe Browsing bypasses could lead to secondary compromises (e.g., credential theft from phishing). However, this is not a critical exploit-in-the-wild issue and does not warrant immediate business disruption; schedule updates as part of normal maintenance cycles.

Risk score, explained

The CVSS v3.1 score of 4.3 (MEDIUM) reflects: network-based attack vector, low complexity, no privilege requirements, but a requirement for user interaction. The integrity impact indicates the attack undermines Safe Browsing's protective function, but there is no direct confidentiality or availability impact on the user's system itself. The score appropriately captures the moderate risk: not critical, but meaningful enough to warrant timely remediation. Chromium's internal Low severity rating likely emphasizes that this is a feature bypass rather than a system-level compromise.

Frequently asked questions