CVE-2026-11691: Chrome New Tab Page Cross-Origin Data Leak – Patch Now

Technical summary

CVE-2026-11691 is an input validation deficiency (CWE-20) in Chrome's New Tab Page component that failed to properly validate untrusted input, enabling cross-origin data leakage. The vulnerability existed in Chrome versions prior to 149.0.7827.103. Exploitation requires an attacker to have already gained code execution in the renderer process—a privileged execution context within the browser sandbox—and then serve a specially crafted HTML page to the victim. Under these conditions, the attacker could read data from origins other than the crafted page, violating the same-origin policy that normally isolates web content.

Business impact

The business risk is moderate but contingent on prior compromise. Organizations where employees use Chrome face exposure only if an attacker has already successfully compromised the renderer process through another vulnerability or attack vector. The secondary step of crafting a malicious page and steering users to it is relatively straightforward once renderer access is obtained. For enterprises running Chrome on unpatched systems, this creates a chaining risk: a first vulnerability could be leveraged alongside this one to escalate data theft. Affected users could have sensitive information from cross-origin sites exposed, including session tokens, form data, or other confidential content.

Affected systems

The vulnerability affects Google Chrome prior to version 149.0.7827.103 across Windows, macOS, and Linux systems. The listing also includes Linux kernel and Windows as affected platforms, likely because Chrome runs on those operating systems; however, the vulnerability is specific to Chrome itself. Any installation of Chrome below the patched version 149.0.7827.103 on any of these platforms should be considered at risk.

Exploitability

Exploitability is constrained but not negligible. An attacker must first achieve renderer process compromise—a significant barrier that typically requires exploiting a separate vulnerability. Once renderer access is obtained, the attack surface simplifies: the attacker crafts a malicious HTML page and must convince the user to navigate to it (user interaction is required per the CVSS vector). The attack is not a one-click remote code execution; it is a post-compromise technique that extends the damage of an already-successful attack. The CVSS score of 3.1 reflects these prerequisites, though the internal Chromium severity of High underscores that defenders should not underestimate the impact once a renderer is compromised.

Remediation

Update Google Chrome to version 149.0.7827.103 or later. Chrome's auto-update mechanism should handle deployment, but verify the version in Chrome Settings > About Google Chrome to confirm. Users and administrators should enable automatic updates and restart the browser to activate the patched version. No workarounds are documented; patching is the required remediation.

Patch guidance

Patch Chrome to 149.0.7827.103 or later at your earliest convenience. While the CVSS score is low, the requirement that an attacker must first compromise the renderer process means this vulnerability is typically part of a multi-stage attack. Prioritize patching in environments where other high-severity Chrome vulnerabilities have been found or if you have indicators of renderer-exploitation attempts. Verify the update installation by navigating to Chrome Settings > About Google Chrome; the browser will display the installed version and confirm if it is up to date.

Detection guidance

Detection is difficult because the vulnerability manifests as suspicious cross-origin data access within an already-compromised renderer process. Monitor for unexpected data exfiltration or unusual cross-site requests originating from Chrome processes. Behavioral signals include: users visiting untrusted or suspicious web pages followed by data access anomalies, or Chrome processes making unexpected network connections to attacker-controlled domains. Endpoint detection and response (EDR) tools may flag unusual inter-process communication or memory access patterns if they have visibility into renderer behavior. Log authentication events and session activity for signs of compromised accounts that could result from stolen credentials accessed via this vulnerability.

Why prioritize this

This vulnerability merits prompt but not emergency attention. The CVSS score of 3.1 places it at low priority in isolation, but the Chromium High severity rating and the risk of chaining with other vulnerabilities warrant timely patching. Organizations should batch this update with other Chrome security patches in a regular maintenance cycle. If your environment has evidence of renderer-exploitation attempts or if you are running other unpatched high-risk Chrome vulnerabilities, elevate the priority of this patch.

Risk score, explained

The CVSS 3.1 score of 3.1 (Low severity) reflects the requirement that an attacker must already control the renderer process (a significant prerequisite) and that the user must interact with a crafted page. The attack vector is network-based, but access is not adjacent and user interaction is required, both of which reduce the score. The confidentiality impact is limited (reading cross-origin data), and there is no integrity or availability impact. However, the Chromium team's High internal severity rating acknowledges that once the renderer is compromised—via an unrelated vulnerability—this flaw becomes a powerful tool for escalating data theft, justifying timely remediation despite the low CVSS score.

Frequently asked questions