CVE-2026-11695: Chrome Password Feature Cross-Origin Data Leak

Technical summary

This vulnerability stems from an inappropriate implementation in Chrome's password feature that fails to properly isolate data between different website origins. Classified under CWE-693 (Insufficient Protection of Assets Against Unauthorized Access), the flaw permits a remote, unauthenticated attacker to exfiltrate cross-origin data via a specially crafted HTML page. The attack vector is network-based with low complexity, requires user interaction (visiting a malicious page), and results in confidentiality impact without affecting integrity or availability. Chromium security researchers designated this as High severity within their internal framework.

Business impact

This vulnerability primarily threatens users whose browsers store sensitive credentials or session data. Organizations managing users who rely on Chrome for accessing sensitive web applications face a risk that attackers could extract authentication tokens, session identifiers, or other cross-origin data. The attack requires social engineering—tricking a user into visiting a malicious site—but the payload requires no exploitation of other flaws. For enterprises using Chrome as an approved browser, this represents a data leakage risk that could compromise access controls or credential integrity if cached secrets are exposed.

Affected systems

Google Chrome on Windows, macOS, and Linux distributions are affected. All versions prior to 149.0.7827.103 contain the vulnerability. Since Chrome updates automatically on most systems, the affected population shrinks rapidly once patches are released, but organizations with auto-update disabled or browsers in isolated environments remain at risk.

Exploitability

Exploitation requires no special privileges or complex attack infrastructure. An attacker crafts a malicious HTML page and distributes it through phishing, malvertising, or compromised websites. User interaction is mandatory—the victim must visit the attacker-controlled page while logged into sensitive sites. The low complexity and network-based vector make this practical for targeted campaigns against high-value targets, though mass exploitation is less likely given the social engineering requirement.

Remediation

Update Google Chrome to version 149.0.7827.103 or later. Most users benefit from Chrome's automatic update mechanism, which deploys patches within days of release. Organizations should verify patch deployment through their endpoint management tools and confirm that auto-update has not been disabled via group policy or configuration management. Users on unsupported platforms should upgrade their operating systems or migrate to supported browsers.

Patch guidance

Patch deployment for Chrome is straightforward due to its automatic update architecture. Verify the installed version in Chrome's settings (three-dot menu → Help → About Google Chrome) and confirm it displays 149.0.7827.103 or higher. Organizations using managed deployments can enforce updates through group policies on Windows or configuration management on macOS and Linux. If auto-update is disabled, re-enable it or schedule manual updates. For enterprise environments, test patch compatibility in non-production browsers before broad rollout, though Chrome's standard release process typically minimizes compatibility risk.

Detection guidance

Detection of exploitation attempts is challenging because successful attacks leave minimal forensic traces—the attacker merely reads data already present in the browser. Monitor for unusual network connections from browsers to unexpected external domains, though this may generate noise in normal web browsing. More effective is tracking Chrome version adoption rates across the organization: confirm that the vast majority of deployed instances report version 149.0.7827.103 or later. Endpoint detection and response (EDR) tools may flag suspicious page interactions if they correlate with credential-stealing patterns, but this requires tuning to avoid false positives. Focus detection efforts on users who visit high-risk external sites or receive phishing emails, as these users face the highest attack probability.

Why prioritize this

Although the CVSS score of 4.3 (Medium) suggests lower priority, context matters. The attack requires only network access and user interaction, with zero additional exploitation complexity, making it practical for attackers. The impact—leaking cross-origin data and potentially session credentials—could lead to unauthorized access to sensitive applications. However, the mandatory user interaction step provides a natural control; users who avoid suspicious links face significantly reduced risk. Prioritize patching for users in high-risk roles or those who handle sensitive data, then extend to the broader user base. The rapid deployment cycle of Chrome patches means full remediation is achievable within days to weeks for most organizations.

Risk score, explained

The CVSS 3.1 score of 4.3 reflects a network-accessible vulnerability with low attack complexity and required user interaction, resulting in low confidentiality impact and no integrity or availability impact. Chromium's internal severity designation of 'High' reflects that password-related flaws receive elevated scrutiny regardless of technical CVSS metrics. The discrepancy highlights that CVSS measures technical exploitability, not business consequence; leaking cross-origin data through password features is treated seriously by browser vendors even when the attack surface is somewhat constrained. The absence of a CISA KEV listing underscores that this is not yet observed in active, widespread exploitation.

Frequently asked questions