Google Chrome CVE-2026-11254

Exploitation requires that a victim user navigate to a crafted HTML page using an unpatched version of Google Chrome prior to 149.0.7827.53. The CVSS vector confirms unauthenticated remote access (PR:N) is sufficient but user interaction is mandatory (UI:R) - passive drive-by exploitation without any user action is not possible. No special Chrome configuration or feature flag is identified as a prerequisite beyond running the vulnerable version. Exploitation is limited to desktop Chrome; mobile Chrome (Android/iOS) versioning is not addressed in the provided data and should be verified separately. The low integrity-only impact means exploitation does not grant code execution or access to sensitive data directly.

The overall risk from this vulnerability is low. The CVSS base score of 4.3 reflects the limited impact: no confidentiality or availability impact, and only low integrity impact. The attack vector is network-based with no privileges required, which increases theoretical exposure, but the mandatory user interaction (UI:R) and unchanged scope (S:U) significantly constrain real-world exploitation. EPSS data is not provided, and the absence of a KEV entry and public exploit code further reduces urgency. Chromium's own triage categorizes this as 'Low' severity. The tag 'Information Disclosure' appears inconsistent with the CVSS confidentiality rating of C:N - this is more accurately a trust/integrity issue where users may be deceived, not one where sensitive data is directly leaked. Defenders should prioritize this behind higher-severity Chrome issues but include it in routine patch cycles.

An attacker hosts a crafted HTML page that exploits the permissions UI misrepresentation flaw, causing Chrome to display a spoofed or misleading permission dialog - for example, making a prompt appear to originate from a trusted site or obscuring the true nature of the requested permission. A user visiting this page is deceived into granting a browser permission they would otherwise deny, potentially enabling further attacker-controlled actions contingent on that permission. No public exploit code exists at time of analysis, so this scenario currently requires attacker-developed tooling.