Google Chrome CVE-2026-11229

Physical access to the target device is mandatory (CVSS AV:P) - remote exploitation is not possible. The target must be running a Google Chrome Enterprise deployment (not standard consumer Chrome) on a version prior to 149.0.7827.53. No privileges are required prior to exploitation (PR:N), meaning the attacker does not need an existing account on the system. No user interaction is required (UI:N) beyond the attacker's own physical actions. Exploitation is limited by the physical access barrier, the Enterprise-specific deployment context (standard non-managed Chrome installs may not be affected), and the non-automatable nature of the attack as confirmed by SSVC. High confidentiality impact is possible, but integrity and availability are unaffected.

Converging signals across all available frameworks indicate low real-world risk. The CVSS base score of 4.6 is modest, and the physical attack vector (AV:P) is the most restrictive access category, requiring the attacker to be in direct physical contact with the device. EPSS at 0.01% (1st percentile) reflects negligible probability of observed exploitation in the wild. SSVC assessment confirms exploitation status as 'none', the attack is not automatable, and technical impact is only partial. The vulnerability is not listed in CISA's KEV catalog. The confidentiality impact is rated High (C:H), meaning successful exploitation could expose sensitive data; however, integrity and availability are unaffected (I:N/A:N). The practical threat is narrowly scoped to physical access scenarios - lost/stolen enterprise devices, insider threats with physical access, or shared workstations in uncontrolled environments. This is a low-urgency patching priority for most organizations, though higher priority for deployments in public-access or shared-device environments such as kiosks or shared labs.

An attacker with physical access to an unattended enterprise-managed Chrome device - such as a lost laptop, a shared kiosk, or a temporarily unsupervised workstation - interacts with the Chrome Enterprise feature to trigger the improper privilege management flaw. By exploiting the misconfigured or improperly implemented Enterprise code path, the attacker escalates their local privileges and gains unauthorized read access to confidential browser data or system resources. No public exploit code exists at time of analysis, so exploitation likely requires manual technique discovery or familiarity with Chrome Enterprise internals.