Google Chrome CVE-2026-11258

Exploitation requires the victim to be running Google Chrome prior to version 149.0.7827.53. The attacker must convince the user to perform 'specific UI gestures' on a crafted HTML page - passive page visits alone are insufficient, as confirmed by CVSS UI:R. No attacker-side authentication or elevated privileges are required (PR:N). The attack is limited by the mandatory social engineering step to elicit specific user actions, the absence of any passive or zero-click trigger pathway, and Chrome's existing File System Access permission model which may display additional user-visible prompts depending on the exact API call sequence. Impact is confined to the browser's own access context (S:U - unchanged scope), meaning privilege escalation to the underlying OS is not indicated by available data.

The CVSS score of 6.5 (Medium) is driven primarily by the high integrity impact (I:H), but several converging signals indicate real-world risk is lower than that score implies. First, the attack requires user interaction (UI:R) - specifically convincing a target to perform 'specific UI gestures,' introducing meaningful social engineering friction beyond passive page visits. Second, EPSS is 0.02% (4th percentile), placing this well below the threshold of statistically likely near-term exploitation. Third, this CVE does not appear in CISA KEV, and no public exploit code has been identified. Fourth, Chromium's own security team rated this 'Low' severity, suggesting the exploit reliability or impact scope may be more constrained than the CVSS vector alone conveys. The combination of these signals - no active exploitation, very low EPSS, mandatory user interaction, and vendor's own low-severity classification - makes this a low operational priority for most organizations compared to other Medium-CVSS vulnerabilities with higher exploitation signals.

An attacker hosts a crafted HTML page that manipulates Chrome's File System Access API and distributes the link via phishing, malvertising, or a compromised website. When the victim visits the page using a vulnerable Chrome version and is guided into performing specific UI gestures (such as button clicks or drag interactions that superficially appear benign), Chrome's discretionary access controls are bypassed, granting the page unauthorized write access to local files or directories beyond what the user explicitly permitted. No public exploit code exists at time of analysis, making opportunistic or automated exploitation unlikely in the near term.