Google Chrome CVE-2026-11243

The CVSS PR:N vector confirms no authentication is required from the attacker. However, exploitation is gated by a mandatory user interaction requirement (UI:R): a victim must visit or be redirected to a crafted HTML page using a vulnerable Chrome browser (any version prior to 149.0.7827.53). The flaw is specific to Chrome's Downloads implementation, meaning the browser must be in a context where the Downloads subsystem is involved in processing or evaluating the crafted page's navigation behavior. Exploitation is further limited by unchanged scope (S:U) - an attacker cannot use this vulnerability alone to escape the Chrome sandbox or pivot to the underlying OS. The impact ceiling (C:L, I:N, A:L) bounds what is achievable: navigation restriction bypass with limited confidentiality exposure and minor availability disruption, but no code execution or data integrity compromise.

The CVSS 5.4 Medium score and Chromium's own 'Low' severity rating are broadly consistent: the attack requires no privileges or special attacker positioning (AV:N/AC:L/PR:N), but mandates user interaction (UI:R) and yields only low confidentiality and availability impact with zero integrity impact (C:L/I:N/A:L). The unchanged scope (S:U) confirms this vulnerability cannot be used to escape the browser sandbox, significantly limiting its standalone damage potential. No EPSS score was provided in the available intelligence, so exploitation probability cannot be quantified numerically. The vulnerability is not listed in the CISA KEV catalog, and no public proof-of-concept exploit has been identified. The net assessment is a lower-priority patching target relative to higher-severity Chrome vulnerabilities - real-world risk is bounded by the UI:R requirement and minimal impact ceiling. However, the AV:N/AC:L/PR:N combination means at-scale exploitation is technically feasible once a working exploit is developed, so timely patching remains advisable.

An attacker hosts a crafted HTML page designed to exploit the origin validation failure in Chrome's Downloads subsystem. A victim using Chrome prior to 149.0.7827.53 is directed to the page - via phishing link, malvertising, or a compromised third-party site - and upon page load, the Downloads implementation is manipulated to bypass navigation restrictions, potentially redirecting the user to unintended destinations or circumventing download-related safety checks. No public exploit code has been identified at time of analysis, but the low attack complexity (AC:L) means a working exploit, once developed, would be straightforward to operationalize at scale.