Google Chrome CVE-2026-11241

Exploitation requires the attacker to be on the same local network segment as the victim (CVSS AV:A - typical home/office LAN, public Wi-Fi, or any broadcast/mDNS-reachable subnet), the victim to be running a Chrome version below 149.0.7827.53 with the Cast feature enabled (it is on by default), and the victim to perform user interaction (CVSS UI:R) by loading the attacker-controlled crafted HTML page in Chrome. No authentication is needed (PR:N) and attack complexity is low (AC:L). The exploit is limited by the adjacency requirement (it cannot be triggered from the internet), the need for user interaction to load the malicious page, and the fact that enterprises with the EnableMediaRouter policy disabled are not exposed; Google's own Chromium severity rating of Low further suggests practical exploitation is constrained.

The CVSS 3.1 vector AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H yields an 8.0 score, driven by the high CIA impact, but the realistic risk is meaningfully lower than that headline number. The Adjacent (AV:A) attack vector restricts attackers to the same local network segment, User Interaction Required (UI:R) means the victim must load the crafted HTML page, and Google's own Chromium severity rating is Low - a strong contrary signal from the vendor closest to the code. The CVE is not on CISA KEV, no EPSS score is provided in the input, and no public exploit has been identified at time of analysis, indicating this is not an emergent priority. For most organizations this is a routine Chrome auto-update item rather than an emergency patch, though environments with shared/untrusted Wi-Fi (cafes, hotels, conference networks, BYOD-heavy enterprises) should prioritize it slightly higher because the adjacency requirement is trivially satisfied there.

An attacker joins the same Wi-Fi network as the target (e.g., an office guest network, hotel, or coffee shop) and lures the victim - via a phishing link, malvertising, or a captive-portal redirect - into opening a crafted HTML page in Chrome. The page exercises the vulnerable Cast input-handling path, possibly in concert with a rogue device the attacker advertises on the LAN, to escape the page's normal sandbox privileges and gain elevated capabilities within the browser. No public exploit has been identified at time of analysis.