CVE-2026-11273: Google Chrome Omnibox Script Injection Vulnerability (UXSS) – Patch 149.0.7827.53

Technical summary

CVE-2026-11273 stems from insufficient input validation in Chrome's Omnibox component. The vulnerability allows Unfiltered Cross-Site Scripting (UXSS) when specific UI gestures are performed on a crafted HTML page. The Omnibox, responsible for parsing and processing user input for navigation and search, does not adequately sanitize or validate untrusted input before processing it in a security-sensitive context. This permits script injection (CWE-79) due to the underlying input validation weakness (CWE-20). The vulnerability affects Chrome on Windows, macOS, and Linux systems. Chromium maintainers classified this as Low severity internally, though the CVSS 3.1 score of 6.1 reflects Medium severity when accounting for the cross-origin scripting impact and user interaction requirement.

Business impact

While the vulnerability requires user interaction, it enables attackers to execute arbitrary JavaScript within the context of the browser, potentially leading to session hijacking, credential theft, malware delivery, or unauthorized actions on behalf of the user across visited websites. For organizations with strict browser security policies, the ability to inject scripts represents a control bypass. The impact is further amplified in environments where Chromebook or Chrome OS deployments are prevalent, or where Chrome is the primary corporate browser. The requirement for social engineering and specific UI gestures somewhat limits mass exploitation, but targeted attacks against high-value users remain feasible.

Affected systems

Google Chrome prior to version 149.0.7827.53 on all supported platforms is affected: Windows, macOS, and Linux distributions. This includes both enterprise and consumer deployments. Any user running an unpatched Chrome version on these operating systems is at risk if they visit a malicious website and interact with the Omnibox as directed by the attacker's payload. The vulnerability does not affect other Chromium-based browsers unless they have adopted the vulnerable code path unchanged.

Exploitability

The exploit chain requires: (1) creation of a crafted HTML page hosted by the attacker, (2) social engineering or phishing to convince a user to visit the page, and (3) the user performing specific UI gestures in the Omnibox (such as typing, selecting text, or invoking autocomplete suggestions). The barrier to exploitation is non-trivial due to the UI gesture requirement and the need for user interaction, which explains the lower Chromium severity rating. However, the attack surface is broad—any website a user visits can be weaponized. The vulnerability is not currently on CISA's Known Exploited Vulnerabilities (KEV) list, indicating no evidence of active in-the-wild exploitation at the time of publication, though this does not preclude future exploitation.

Remediation

Update Google Chrome to version 149.0.7827.53 or later. Chromium's auto-update mechanism will deliver the patch automatically on most systems, though administrators should verify deployment in managed environments. Organizations using Chrome Enterprise can verify patch status via the Chrome Management console. Users on unsupported OS versions (e.g., older Windows or macOS) should verify vendor support status and apply any available security updates from their OS vendor. Consider deploying browser policies that restrict navigation to untrusted domains or require additional confirmation for address bar interactions if feasible within your security framework.

Patch guidance

Patch availability: Google Chrome 149.0.7827.53 or later. Deployment approach: (1) Consumer users: Enable automatic updates and restart Chrome. Check Settings > About Chrome to force immediate update. (2) Enterprise/Managed: Deploy via Chromium Enterprise release channels (stable, beta, dev). Use your Mobile Device Management (MDM) or Group Policy infrastructure to enforce minimum version requirements. (3) Verification: Confirm patch application by checking Chrome://version or navigating to Settings > About Chrome and confirming version is 149.0.7827.53 or higher. No known breaking changes or compatibility issues associated with this patch have been reported.

Detection guidance

Detection approaches: (1) Network monitoring: Flag HTTP/HTTPS traffic to domains known for XSS payload delivery or malicious HTML hosting; correlate with Chrome Omnibox interaction patterns if telemetry is available. (2) Endpoint security tools: Monitor for Chrome process anomalies or unexpected script execution within Chrome's sandbox following Omnibox interaction events. (3) User awareness: Educate users to avoid typing sensitive queries or credentials directly in the Omnibox if prompted by unsolicited website content. (4) Proactive patching: Scan managed endpoints for Chrome version < 149.0.7827.53 and prioritize remediation in accessible-to-external-users scenarios. No specific IOCs (indicators of compromise) are known, as the vulnerability is in input handling rather than a backdoor or command-and-control pattern.

Why prioritize this

Prioritize this patch for deployment within 30 days in most environments. Reasoning: (1) Medium CVSS (6.1) with cross-site scripting impact is not critical but significant; (2) broad platform coverage (Windows, macOS, Linux) means risk exposure is widespread; (3) user interaction requirement and active social engineering barrier reduce immediate critical risk; (4) no evidence of active exploitation (KEV list status: false) allows for orderly, planned deployment rather than emergency response; (5) Chrome's auto-update mechanism means many consumer users will be protected automatically, reducing overall exposure velocity. Organizations with high-risk user populations (e.g., those handling sensitive data or subject to targeted attacks) should accelerate to 14-day timeframe.

Risk score, explained

CVSS 3.1 score of 6.1 (Medium) reflects: Attack Vector (Network) = maximum exposure via web; Attack Complexity (Low) = no special conditions needed beyond a crafted page; Privileges Required (None) = unauthenticated attacker; User Interaction (Required) = a user must perform specific Omnibox gestures, raising the bar somewhat; Scope (Changed) = the vulnerability impacts resources beyond the vulnerable component (other visited websites via script injection); Confidentiality (Low) and Integrity (Low) impacts due to potential data exfiltration or DOM modification; Availability (None) = no denial-of-service vector. The CVSS score is appropriate for a UI-dependent XSS variant with network-wide reachability but non-trivial interaction requirements.

Frequently asked questions