CVE-2026-11288: Cross-Origin Data Leak via CSS in Chrome – Patch Guidance

Technical summary

CVE-2026-11288 is a policy enforcement bypass in Chrome's CSS processing that enables cross-origin data exfiltration. The vulnerability exists in Chrome versions prior to 149.0.7827.53 and is rooted in CWE-693 (Improper Protection of Alternate Path). The CVSS 3.1 score of 6.5 reflects high confidentiality impact with network-based attack feasibility and minimal user friction. The flaw allows an attacker hosting a malicious HTML page to read sensitive cross-origin data through CSS side-channel or parsing mechanisms, defeating Chrome's same-origin policy enforcement at the CSS layer. While Chromium's security team rated this as Low severity internally, the CVSS assessment reflects the practical risk of data leakage to an unauthenticated network attacker.

Business impact

Data confidentiality is the primary business concern. Users of Chrome may unknowingly leak session information, personal data, or authentication tokens to attacker-controlled sites. Organizations relying on Chrome for accessing sensitive cloud applications, SaaS platforms, or internal web services face potential credential or session compromise without user awareness. The attack requires no malware installation or system-level access—only a visit to a malicious page—making it a realistic threat vector in phishing or watering-hole campaigns. Browser-based attack surface is difficult to monitor and attribute, complicating incident response.

Affected systems

Google Chrome is the primary affected product. The vulnerability also impacts Chrome on Apple macOS, Linux systems, and Microsoft Windows platforms through the shared Chromium codebase. Any system running Chrome version 149.0.7827.52 or earlier is vulnerable. Organizations should inventory Chrome deployments, including corporate instances, personal devices connected to corporate networks, and environments where Chrome is used to access sensitive applications.

Exploitability

Exploitability is straightforward. An attacker needs only to craft an HTML page containing malicious CSS and hosting it on the internet or injecting it into a compromised website. The attack vector is network-based with low complexity and no privilege requirement. The barrier to exploitation is low: standard web development skills and a page view suffice. No browser plugins, user system access, or advanced user interaction (beyond a click) is necessary. This makes the vulnerability practically exploitable in real-world scenarios such as ads, third-party content, or spear-phishing links.

Remediation

Update Google Chrome to version 149.0.7827.53 or later on all affected operating systems. Chrome's auto-update mechanism typically deploys patches within days, but organizations with managed deployments should verify update completion. Users should check their Chrome version (chrome://settings/help) and allow updates to install. For organizations managing Chrome, verify policy configurations permit security updates and consider forcing updates through group policy or device management solutions if available.

Patch guidance

Google Chrome 149.0.7827.53 and all later versions contain the fix. Verify patch version directly in chrome://settings/help or chrome://version/. For macOS, Windows, and Linux, the same version numbering applies across platforms. Organizations using Chrome Enterprise should review their update deployment pipelines to ensure the patched version is being distributed. Test patch deployment in a limited environment first to confirm no compatibility issues with internal web applications or extensions before full rollout.

Detection guidance

Monitor for CSS-based attacks by examining HTTP request logs for unusual CSS file requests or inline styles from untrusted sources. Look for anomalous data exfiltration patterns in network traffic from Chrome processes, particularly connections to unexpected external domains during web browsing sessions. Browser extensions or endpoint detection solutions that track CSS processing or cross-origin resource access may flag suspicious activity. Consider deploying web content filtering to block known malicious domains. User behavior analytics can help identify cases where credentials or session tokens appear in logs of attacker-controlled infrastructure. Chrome's Safe Browsing integration may detect some malicious pages; ensure it remains enabled.

Why prioritize this

This vulnerability merits prompt patching because it enables silent data exfiltration without user awareness or consent, affects millions of Chrome users globally, requires minimal attacker skill, and has no clear compensating controls. While not yet in active exploitation campaigns tracked by CISA, the low barrier to exploitation and high prevalence of Chrome make it a realistic target for opportunistic attackers. Organizations handling sensitive data via web browsers should treat this as a near-term priority. The automatic update mechanism in Chrome mitigates risk for most users, but managed deployments and users with disabled auto-updates face elevated risk.

Risk score, explained

The CVSS 6.5 (MEDIUM) reflects high confidentiality impact combined with low attack complexity and no privilege requirement. The score is driven by the ease of crafting and delivering the attack and the direct leakage of sensitive cross-origin data. No integrity or availability impact moderates the score. The real-world risk is amplified by Chrome's ubiquity and the invisibility of data exfiltration to end users, making the practical risk profile higher than a typical MEDIUM score suggests. Organizations should weight this more heavily if employees access financial, healthcare, or authentication platforms via Chrome.

Frequently asked questions