CVE-2026-11292: Chrome CSP Bypass in Blink Rendering Engine – CVSS 4.3

Technical summary

The vulnerability stems from insufficient policy enforcement in Blink's Content Security Policy implementation (CWE-693: Improper Neutralization of Equivalent Keywords in Access Control Lists). An attacker crafting a specially designed HTML page can circumvent CSP headers that normally restrict script execution, resource loading, and other dangerous behaviors. The flaw requires user interaction—the victim must visit the attacker's crafted page—and does not affect system confidentiality or availability, only the integrity of the security boundary that CSP establishes. The rendering engine fails to properly validate or enforce CSP directives under specific conditions that the attacker can manipulate.

Business impact

This vulnerability degrades the effectiveness of a critical web security control. For organizations relying on CSP to mitigate XSS and injection attacks on internal web applications or customer-facing properties, a successful exploit could allow attackers to inject malicious scripts or content that bypasses those defenses. The practical impact depends on what resources CSP was intended to protect; however, since exploitation requires the user to actively visit a malicious page, the attack surface is limited to scenarios where social engineering or phishing succeeds. Organizations with strict CSP policies intended to prevent script injection will find those policies circumvented on vulnerable Chrome versions.

Affected systems

The vulnerability affects Google Chrome prior to version 149.0.7827.53. As Blink is Chrome's rendering engine, the flaw is inherent to Chrome itself. While vendors_products lists macOS, Windows, and Linux, these are the operating systems on which vulnerable Chrome installations run; the vulnerability is not in the OS kernels themselves but in the Chrome browser. Any user or system running Chrome before 149.0.7827.53 is at risk if they visit a crafted webpage.

Exploitability

Exploitability is moderate. The attack requires user interaction—the victim must visit a webpage controlled or influenced by the attacker—making it unsuitable for mass exploitation but practical for targeted attacks or watering-hole scenarios. An attacker does not need special privileges or system access; they only need to craft a malicious HTML page and convince or trick a user to visit it. The technical barrier to crafting the exploit is low to moderate, depending on the specific CSP bypass technique. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog as of the data snapshot, suggesting no in-the-wild exploitation has been widely reported, though that status can change.

Remediation

Update Google Chrome to version 149.0.7827.53 or later. Chrome typically updates automatically, but users should verify their version (menu > Help > About Google Chrome) to confirm they are current. Organizations managing Chrome through Group Policy or device management solutions should deploy the patch through those mechanisms. No workaround exists for the underlying flaw; patching is the only mitigation. Users should also be reminded of security best practices: avoid clicking links from untrusted sources, and review CSP headers on their web applications to ensure they are configured correctly.

Patch guidance

Google Chrome version 149.0.7827.53 and later contain the fix. Most Chrome users will receive the update automatically, typically within days of release. Verify successful patching by navigating to chrome://version or the About Chrome page in the browser. Enterprise deployments can validate patch deployment through their mobile device management (MDM) or browser management tools. If you maintain web applications that rely on CSP for security, test CSP policies in the patched version to ensure they function as intended and do not rely on any workarounds for this bug. There is no indication that the patch introduces breaking changes for standard CSP configurations.

Detection guidance

At the endpoint level, monitor Chrome version compliance to ensure systems are not running versions prior to 149.0.7827.53. Browser telemetry or device inventory tools can enumerate Chrome versions across your fleet. At the web application level, if you serve content that depends on CSP enforcement, review access logs and security events for anomalous script execution or unexpected content injection following the vulnerability publication date (June 5, 2026) and before patch deployment in your environment. Test your CSP policies in both vulnerable and patched versions to confirm whether your configuration was affected by this bypass. Network-level detection is difficult because the attack is invisible to the network—it depends on the browser's parsing of CSP headers, which occurs client-side.

Why prioritize this

This vulnerability merits prompt but not emergency patching. The CVSS score of 4.3 (MEDIUM) reflects the integrity impact and ease of attack, but the requirement for user interaction limits the blast radius. Prioritize patching for systems that: (1) handle sensitive web applications where CSP is a critical defense layer, (2) are exposed to users who may be social-engineered into visiting malicious sites, or (3) are used by high-value targets (e.g., security researchers, journalists). Standard enterprise users browsing the general web should still be patched promptly via normal update cycles, but this is not a 'drop everything' emergency patch like a zero-day RCE would be.

Risk score, explained

The CVSS 3.1 score of 4.3 (MEDIUM) is derived from: Network attack vector (attacker can exploit remotely), Low attack complexity (no special conditions required), No privileges required, User interaction required (victim must visit the malicious page), Unchanged scope (no privilege escalation outside the browser sandbox), No confidentiality impact, Low integrity impact (CSP bypass allows unintended modifications), and No availability impact. The score reflects that while the attack is easy to mount and does not require victims to have special credentials, it is constrained by the need for user action and limited to compromising the integrity of CSP protections rather than stealing data or crashing systems. Chromium's internal severity rating of 'Low' differs from the CVSS 'MEDIUM' because CVSS factors in the attack surface (unauthenticated network access) while Chromium's rating may weigh the specific harm narrower.

Frequently asked questions