Google Chrome CVE-2026-11267

Exploitation requires that the victim be convinced to install a specifically crafted malicious Chrome extension - this is a hard prerequisite and the primary limiting factor. The CVSS vector UI:R confirms mandatory user interaction; there is no path to exploitation without this social engineering step. The attacker requires no prior authentication or privileges on the target system (PR:N), and attack complexity is low (AC:L) once the extension is installed. Exploitation is limited to the Chrome browser's desktop platforms only; the flaw is confined to the Extensions subsystem, meaning websites or systems not accessed through the compromised browser are unaffected. The integrity impact is low and scoped to the browser session (S:U), with no confidentiality or availability consequences confirmed by the CVSS vector.

The aggregate signal picture indicates low real-world priority. CVSS 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) reflects a network-reachable, low-complexity attack that nonetheless mandates explicit user interaction (UI:R) - the victim must be socially engineered into installing a malicious extension. The scope is unchanged (S:U), with only low integrity impact and no confidentiality or availability impact. EPSS at 0.01% (1st percentile) corroborates that mass exploitation is not occurring. There is no CISA KEV listing and no public exploit code identified. The Chromium project itself rates this 'Low' severity. The primary realistic risk is targeted CSP-bypass as a supporting step in a broader attack chain (e.g., XSS enablement or policy evasion), rather than standalone critical compromise. No conflicting signals are present; CVSS vector and description align consistently.

An attacker crafts a Chrome extension that appears legitimate - a productivity tool, ad-blocker, or theme - and distributes it via a phishing campaign, social media link, or sideloading instruction. Once a victim installs the extension, it exploits the insufficient CSP enforcement to inject unauthorized scripts or modify page content on target websites, potentially enabling subsequent XSS-style attacks or data manipulation that CSP was intended to prevent. No public proof-of-concept code has been identified at time of analysis, and the low EPSS score suggests this scenario remains largely theoretical rather than observed in active campaigns.