Google Chrome CVE-2026-11268

Victim must be running Google Chrome on Windows (platform-specific; macOS and Linux are not identified as affected). Victim must visit or be navigated to an attacker-controlled or attacker-compromised HTML page - this is mandatory user interaction per UI:R in the CVSS vector. The attacker requires no authentication and no privileges (PR:N). Exploitation is limited to the confidentiality dimension only; no code execution or data modification is possible via this vulnerability alone. The uninitialized memory condition is triggered through graphics API calls (ANGLE/WebGL), so environments with WebGL disabled via Chrome enterprise policy (--disable-webgl flag or WebGL blocklist policy) may reduce the exploitable surface, though this is not confirmed by vendor advisory. No server-side configuration is required; any default Chrome on Windows installation prior to 149.0.7827.53 is potentially vulnerable.

CVSS 6.5 with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N reflects a network-reachable, low-complexity attack requiring no attacker privileges but mandatory victim interaction, with high confidentiality impact and no integrity or availability impact. The UI:R requirement meaningfully reduces real-world risk because a victim must navigate to or be redirected to a crafted page. EPSS of 0.03% at the 11th percentile signals that the security community broadly assesses exploitation as unlikely in the near term. The vulnerability is not listed in the CISA KEV catalog and no public exploit code has been identified. Google's own severity rating of 'Low' further supports a lower operational priority. However, the C:H score is noteworthy for a data-leakage-only bug - successful exploitation could expose sensitive cross-origin content such as authenticated session data rendered in a co-located tab or iframe. Organizations with high-sensitivity browsing environments (government, finance) should treat patching as routine but not emergency. The absence of integrity or availability impact, combined with the low EPSS, indicates this is not a mass-exploitation target at this time.

An attacker hosts a crafted HTML page that triggers specific ANGLE graphics operations designed to surface uninitialized memory during rendering. The attacker lures a victim Chrome user on Windows - via phishing email, malicious advertisement, or compromised website - to visit the page. Chrome's ANGLE layer processes the crafted WebGL or graphics calls and returns uninitialized buffer contents that may include cross-origin data, which the attacker's page script can then exfiltrate. No public exploit code has been identified, and successful exploitation requires victim interaction with a controlled page.