Google Chrome CVE-2026-11271

Exploitation requires the victim to be running Google Chrome prior to version 149.0.7827.53 on a desktop platform. The attacker must direct the victim to a crafted HTML page AND successfully manipulate the victim into performing specific UI gestures - passive page load alone is insufficient, as confirmed by UI:R in the CVSS vector. The vulnerability is in the Passwords component, implying the user likely needs Chrome's built-in password manager active and engaged during the interaction (a non-default opt-out scenario for most Chrome users, but not a specialized enterprise configuration). The CVSS vector confirms no attacker privileges are required (PR:N). Limiting factors: (1) mandatory user interaction with precise gestures, requiring effective social engineering beyond a simple click-through; (2) no confirmed exploitation campaigns or public exploit code; (3) low EPSS of 0.03% indicating this attack is not being operationalized broadly; (4) the Chromium team's Low severity rating suggests the leaked data type or accessible conditions are more constrained than C:H implies in isolation. Defenders should assess risk in proportion to their user population's likelihood of interacting with untrusted web content while Chrome's password manager is active.

The CVSS score of 6.5 is driven primarily by the high confidentiality impact (C:H) and network attack vector (AV:N) with no required privileges (PR:N), which could suggest urgent priority. However, cross-referencing all available signals substantially lowers practical risk: the attack requires user interaction with specific UI gestures (UI:R), not merely passive page visits; EPSS is 0.03% at the 11th percentile, indicating this class of attack is not being observed in exploitation campaigns; CVE-2026-11271 is absent from the CISA KEV catalog, confirming no verified active exploitation; and the Chromium security team's own severity rating is Low, suggesting internal assessment places the accessible data or realistic trigger conditions as more constrained than the raw CVSS vector implies. The CVSS C:H score may overstate impact if the leaked data is limited in scope or already partially accessible by the attacking origin. No SSVC exploitation status data is available in the provided intelligence. This vulnerability should be patched through Chrome's standard update cycle but does not warrant emergency out-of-band response for most organizations. The primary realistic victims are users with saved passwords in Chrome's built-in manager who can be socially engineered into specific in-page interactions on attacker-controlled sites.

An attacker registers a malicious website and serves a crafted HTML page to a Chrome user who has saved credentials in Chrome's built-in Password manager. The page employs social engineering techniques - such as fake CAPTCHA prompts, fake login flows, or deceptive UI overlays - to induce the victim into performing the specific UI gestures that trigger the inappropriate implementation in Chrome's Passwords component, causing cross-origin credential or session data to be silently transmitted to the attacker-controlled origin. No public exploit code has been identified at time of analysis, making this scenario currently dependent on a threat actor with independent knowledge of the exact trigger gestures.