Google Chrome CVE-2026-11265

Exploitation requires the victim to navigate a vulnerable Chrome desktop build (any version prior to 149.0.7827.53) to an attacker-controlled HTML page; no authentication to a target site is technically required by the CVSS vector (PR:N, UI:N), but practical exploitation depends on the user having previously stored Autofill data (addresses, payment methods, or other form values) tied to the cross-origin target the attacker wishes to leak. Limiting factors: the user must reach the crafted page (phishing or malvertising delivery), Autofill must be enabled and populated for the targeted origin, and Chrome's standard auto-update flow rapidly closes the window of exposure for non-managed installs.

Signals here are mixed and skew lower than the headline CVSS suggests. The CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N yields 7.5 because the confidentiality impact is rated High with no privileges or user interaction required, but Chromium's own triage assigned only 'Low' severity, and the EPSS score is 0.03% (11th percentile), indicating very low exploitation probability. The CVE is not on CISA KEV, no public PoC is referenced, and the vulnerability is a data-leak issue rather than RCE or sandbox escape. There is some tension between UI:N in the CVSS vector and the description's requirement that the victim visit a 'crafted HTML page,' which in practice constitutes user-driven navigation - defenders should treat this as opportunistic phishing-class risk rather than worm-grade exposure. Patch deployment via Chrome's standard auto-update channel should be sufficient for the vast majority of environments.

An attacker hosts a malicious page that abuses the Autofill implementation flaw to trigger insertion or readout of data tied to another origin (for example, a banking or webmail domain) while the victim browses with a vulnerable Chrome build. When the user is lured to the page through phishing, malvertising, or a compromised site, the attacker silently harvests cross-origin form data such as saved addresses or payment fields. No public exploit identified at time of analysis, though the Chromium issue tracker reference may become a starting point for researchers once unrestricted.