Google Chrome CVE-2026-11252

Exploitation requires that the target is running Google Chrome prior to version 149.0.7827.53 and visits a crafted HTML page controlled by the attacker (UI:R per CVSS vector). The CVSS vector confirms the attacker requires no authentication (PR:N) and no special server configuration - any web server hosting the malicious page suffices. Exploitation is concretely limited by the mandatory user interaction requirement: the victim must navigate to or be redirected to the attacker-controlled page, introducing a social engineering dependency. The vulnerability affects Chrome's Content Settings enforcement layer specifically; the impact is bounded to a limited integrity bypass (I:L) with no confidentiality or availability consequence, meaning an attacker cannot read data or crash the browser through this flaw alone. Environments where Chrome Content Settings are not relied upon as a meaningful security boundary face reduced practical risk.

The CVSS 4.3 base score reflects a narrow, integrity-only impact (I:L) with no confidentiality or availability consequences, meaningfully limiting the damage potential. The network attack vector (AV:N) and low complexity (AC:L) lower the bar for exploitation, but the mandatory user interaction (UI:R) introduces a social engineering dependency - a victim must be directed to a crafted page. No EPSS data was supplied in the intelligence sources, so probabilistic exploitation likelihood cannot be quantified from this dataset. The vulnerability is not listed in CISA KEV, no POC has been identified, and Google's internal severity rating is Low - all signals converge on low real-world priority. For enterprises using Chrome's Content Settings policies as an enforced security boundary (e.g., managed browser fleets with policy-mandated permission restrictions), risk is slightly elevated; for standard consumer deployments, this is a routine patch-cycle item. No conflicting signals were identified in the available data.

An attacker crafts a malicious HTML page that triggers Chrome's Content Settings policy enforcement flaw and distributes the URL via phishing email or malicious advertisement targeting users running Chrome prior to 149.0.7827.53. When a victim navigates to the page, Chrome's insufficient policy enforcement allows the page to bypass intended Content Settings access controls, potentially overriding site permission restrictions that a managed or security-conscious user would expect to be enforced. No public exploit or POC has been identified at time of analysis, meaning realistic exploitation currently requires independent capability to discover and implement the bypass technique.