Google Chrome CVE-2026-11266

User interaction is required per CVSS (UI:R) - the victim must visit a malicious URL or explicitly initiate download of a crafted file within an affected Chrome session. The attacker needs no authentication and requires no special privilege (PR:N); the only prerequisite is the ability to deliver a malicious URL or file link to a target using Chrome prior to 149.0.7827.53. No non-default configuration is required - any default Chrome desktop installation with SafeBrowsing enabled and running a pre-patch version is potentially affected. Exploitation is bounded by two limiting factors: user interaction cannot be automated away by the attacker alone, and the bypass does not itself grant code execution - it only suppresses the SafeBrowsing warning, meaning a separate payload mechanism is still required to cause harm.

The CVSS score of 4.3 (Medium) accurately reflects the bounded impact: only low integrity effect, no confidentiality or availability loss, and unchanged scope. The Chromium security team independently rated this 'Low' severity. EPSS at 0.02% (4th percentile) is exceptionally low, indicating minimal observed exploitation probability. No CISA KEV listing and no public POC exist at time of analysis. The SSVC signal is consistent: exploitation is not confirmed, the attack is theoretically automatable at scale (AC:L, PR:N) but real-world targeting is unsupported by available threat data, and technical impact is partial. The primary risk amplifier is indirect: SafeBrowsing bypass removes a user-protective warning layer, making Chrome users more susceptible to downstream malware delivery campaigns. For organizations heavily dependent on Chrome's native protections - particularly those without independent web proxy or endpoint scanning - risk is elevated relative to CVSS alone. No data conflicts in available sources; CVSS network vector is consistent with the remote delivery description.

An attacker hosts a crafted malicious file - such as malware disguised as a legitimate download - on an attacker-controlled web server, designed to exploit the SafeBrowsing implementation flaw. A user running Chrome prior to 149.0.7827.53 visits the page or initiates the download, and Chrome's SafeBrowsing check fails to flag the file, delivering it to the user's system without the expected security warning. The user, lacking the Chrome warning prompt, is more likely to open the file, enabling the downstream malicious payload to execute.