CVE-2026-11658: Chrome Site Isolation Bypass in Extensions (Medium Severity)

Technical summary

CVE-2026-11658 is a site isolation bypass vulnerability affecting Google Chrome versions prior to 149.0.7827.103. The root cause is inadequate input validation (CWE-20) in the Extensions component when processing untrusted data. Site isolation is a process-level sandbox that confines each website to its own renderer process, preventing cross-site data theft even if one site is compromised. This vulnerability allows a remote attacker with control over the compromised renderer process to craft an HTML page that circumvents this isolation boundary. The attack requires user interaction (visiting the malicious page) but assumes the renderer is already under attacker control, indicating this is a post-compromise technique rather than a primary exploitation vector.

Business impact

Organizations face elevated risk if employees with compromised Chrome instances visit attacker-controlled sites, potentially leading to theft of sensitive data across multiple websites accessed in that browser session. The practical impact is moderate because the attack requires a prior renderer compromise; however, it significantly increases the damage of an existing browser compromise. Industries handling sensitive customer data, financial services, and healthcare should prioritize patching to prevent data exfiltration scenarios that span multiple internal or external web applications.

Affected systems

Google Chrome versions before 149.0.7827.103 are vulnerable. The vulnerability affects Chrome across all major platforms: Windows, macOS, and Linux. Users and organizations running unpatched versions of Chrome are at risk if their renderer process becomes compromised through other attack vectors.

Exploitability

Exploitation requires two conditions: (1) the renderer process must already be compromised by an attacker, and (2) the user must visit an attacker-controlled or attacker-modified HTML page. The CVSS vector reflects these prerequisites—network-accessible, low attack complexity, no privileges needed, but user interaction required. The vulnerability is not currently listed in the Known Exploited Vulnerabilities (KEV) catalog, indicating no widespread in-the-wild exploitation has been confirmed by CISA. However, the medium CVSS score and Chromium's High severity rating suggest it warrants prompt patching rather than delayed response.

Remediation

Update Google Chrome to version 149.0.7827.103 or later. Verify the update in Chrome Settings > About Google Chrome, which triggers automatic update checking. Organizations managing Chrome deployments via policy should use enterprise update channels to distribute patches. No workarounds are available for the underlying validation flaw; patching is the only mitigation.

Patch guidance

Patch availability: Chrome 149.0.7827.103 or later contains the fix. Deployment priority should be medium-to-high given the site isolation bypass nature and Chromium's High severity classification. Consider prioritizing systems accessed by employees handling sensitive multi-site workflows (intranet + external vendor portals, for example). Automatic Chrome updates are enabled by default for most users; enterprise administrators should verify successful deployment across their Chrome endpoints within 5–7 days of patch release.

Detection guidance

Detection is challenging because the vulnerability resides in Chrome's internal extension validation logic. Monitor for: (1) Chrome crash dumps or renderer process restarts, which may indicate exploitation attempts; (2) unexpected extension installations or modifications in Chrome profiles; (3) user reports of unusual cross-site data access or authentication anomalies. Browser telemetry and endpoint detection tools that monitor process behavior may flag suspicious renderer activity, but signature-based detection of this specific bypass is difficult. Assume detection will be reactive rather than preventive.

Why prioritize this

While this vulnerability requires a pre-existing renderer compromise, it materially worsens the impact of that compromise by enabling cross-site data theft. The combination of site isolation bypass (a core Chrome security model) and medium-to-high severity rating makes it a priority fix. It ranks below critical vulnerabilities affecting direct code execution paths but above low-severity bugs. Organizations should patch within 2–4 weeks unless they operate in high-data-sensitivity sectors, in which case 1–2 weeks is prudent.

Risk score, explained

The CVSS 3.1 score of 6.5 (Medium) reflects limited attack complexity and user interaction requirements, but no direct confidentiality impact under the standard scoring model. However, this underweights the practical threat: site isolation is a foundational Chrome security feature, and bypassing it—even post-compromise—amplifies data exfiltration risks. The Chromium security team's High severity rating acknowledges this context. Organizations should treat this as higher-risk than the base CVSS suggests when assessing patch scheduling.

Frequently asked questions