Google Chrome CVE-2026-11260

Exploitation requires that the victim open a crafted HTML page in Google Chrome prior to version 149.0.7827.53 - user interaction (UI:R) is a hard prerequisite confirmed by the CVSS vector. The attacker must control or influence the content of the visited page. Exploitation is only meaningful against web applications that deploy Content Security Policy as a security boundary; sites without CSP headers are unaffected by this bypass. No authentication is required on the attacker's side (PR:N per CVSS). Limiting factors include: mandatory user navigation to attacker-controlled or attacker-influenced content, impact ceiling of partial integrity only (no confidentiality breach, no code execution), and the requirement that the victim's environment relies on CSP for a security-relevant function.

The CVSS 4.3 score reflects a network-reachable attack (AV:N) requiring no privileges (PR:N) but mandating user interaction (UI:R) and yielding only limited integrity impact (I:L) with no scope change (S:U). Chromium's own security team rates this 'Low', aligning with the narrow impact boundary. EPSS at 0.01% (2nd percentile) confirms extremely low empirical exploitation probability relative to the broader CVE population. The CVE is not listed in the CISA KEV catalog, and no POC exploit code has been identified in available references. The 'Authentication Bypass' tag in the source data is potentially misleading - the bypass is specifically of CSP policy enforcement, not an authentication or access-control mechanism; security teams should not conflate this with credential or session bypass. Real-world priority is low: exploitation requires user interaction, impact is limited to partial integrity, and the affected functionality (CSP) only matters if the target site actively relies on it as a security boundary. Patch cadence for Chrome's auto-update infrastructure makes this straightforward to remediate at scale.

An attacker crafts a malicious HTML page designed to trigger Chrome's Permissions subsystem in a way that bypasses the target page's Content Security Policy, then delivers it to a victim via phishing email or a compromised website. Once the victim opens the page in an unpatched Chrome browser, the CSP bypass takes effect, potentially allowing the attacker to load restricted external scripts or inject content that the CSP would otherwise block. No public exploit code has been identified at time of analysis, and the required user interaction step limits drive-by exploitation.