Google Chrome CVE-2026-11264

User interaction is required and confirmed by CVSS UI:R - the victim must actively navigate to a crafted HTML page in a vulnerable Chrome version prior to 149.0.7827.53. No authentication is required from the attacker (PR:N per CVSS), and attack complexity is low (AC:L). Exploitation is only meaningful where Content Security Policy is deployed as a defense on the targeted web application; if no CSP policy is declared, there is nothing to bypass and no incremental attacker capability is gained. The exploit is limited in scope (S:U - unchanged), meaning the attacker cannot leverage this vulnerability to escape the page context or affect other browser tabs or the underlying OS. Impact is bounded to integrity only (I:L), with no confidentiality or availability compromise. Exploitation is further constrained by Chrome's auto-update behavior, which rapidly reduces the vulnerable population after a stable channel release.

CVSS 4.3 Medium with vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N presents a mixed risk picture. Network reachability and low attack complexity are concerning, but the mandatory user interaction (UI:R) and strictly limited integrity-only impact (I:L, no C or A) meaningfully constrain real-world danger. EPSS at 0.02% in the 4th percentile strongly corroborates low exploitation likelihood - this is not a vulnerability attracting active attacker interest at time of analysis. There is no CISA KEV entry and no publicly identified proof-of-concept code. For most organizations, this is a low operational priority addressed by Chrome's routine auto-update mechanism. The risk is most relevant to environments where CSP is relied upon as a primary - rather than defense-in-depth - control against content injection, or where Chrome auto-update is deliberately disabled. No conflicting signals between CVSS, EPSS, and vendor severity rating are present.

An attacker registers or compromises a web domain and serves a specially crafted HTML page that exploits Chrome's CSP enforcement flaw to load content that the page's declared policy should block - for example, an inline script or cross-origin resource. A user on a vulnerable Chrome version is directed to the page via a phishing link, malicious advertisement, or compromised site redirect. The attacker can then execute otherwise-restricted content within the page context, potentially enabling follow-on XSS-style attacks against applications that rely on CSP as a primary injection mitigation. No public exploit code has been identified at time of analysis.