Google Chrome CVE-2026-11153

The victim must run Google Chrome at a version prior to 149.0.7827.53 and load an attacker-controlled HTML page that exercises the vulnerable Forms code path; the cross-origin data targeted must be present in the victim's browser session (e.g., loaded in another frame or tab) for the side channel to leak meaningful information. Although the CVSS vector states UI:N, in practice exploitation depends on the user navigating to or rendering attacker-controlled content, which is the standard browser threat model. Limiting factors: Chrome's aggressive auto-update on the Stable Channel means the patched population grows quickly, side-channel leaks typically yield limited per-attempt data, and there is no indication of active exploitation (not in CISA KEV, EPSS 0.03%).

The signals here are notably conflicting and warrant careful interpretation. CVSS 9.1 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:N) suggests critical severity from network-reachable, unauthenticated exploitation with high confidentiality and integrity impact, yet Chromium itself rated the issue Medium and EPSS shows only 0.03% (11th percentile) exploitation probability, with no KEV listing and no public POC. The I:H rating is unusual for a pure information-disclosure side channel and may reflect NVD scoring conservatism rather than true integrity impact - the description only mentions data leakage. Realistically this is a browser side-channel that requires luring a victim to a crafted page (despite UI:N in the vector, browser-side issues practically depend on the user visiting attacker content), making it a meaningful but not emergency-grade fix; prioritize via normal Chrome auto-update cadence rather than out-of-band response.

An attacker hosts a crafted HTML page containing form elements designed to trigger the side channel and entices a victim running pre-149.0.7827.53 Chrome to visit it (phishing link, malvertising, or compromised site). While the victim browses, the malicious page measures observable side effects from the Forms subsystem to infer cross-origin data such as content from authenticated sessions in other tabs or frames. No public POC is identified at time of analysis, making opportunistic mass exploitation unlikely in the short term.