Google Chrome CVE-2026-11283

The target must be running Google Chrome on macOS - Chrome on Windows and Linux is explicitly out of scope per the CVE description. The user must open or otherwise interact with a malicious shortcut file delivered by the attacker (UI:R per CVSS vector), meaning fully automated remote exploitation without user action is not possible. No attacker authentication is required (PR:N per CVSS vector). The Shortcuts feature must be accessible and used in the targeted Chrome session. Exploitation is further limited by: (1) macOS-only platform restriction, (2) mandatory user interaction with an attacker-supplied file, and (3) impact scope confined to navigation restriction bypass with no code execution, credential theft, or denial of service.

The CVSS 6.5 score with vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N describes a network-reachable, low-complexity attack requiring no attacker privileges but mandating user interaction (UI:R), with integrity-only impact and no confidentiality or availability consequences. EPSS at 0.02% (4th percentile) indicates a very low real-world exploitation probability, significantly below the median for CVEs of this CVSS class. The vulnerability is not listed in CISA KEV and no POC has been identified, aligning with Chromium's own 'Low' severity classification. The combination of mandatory user interaction, macOS-only scope, and an impact limited to navigation restriction bypass - rather than code execution or data exfiltration - makes this a real but lower-priority issue for most organizations. Defenders should prioritize patching for macOS Chrome fleet members but should not treat this as an emergency given the absence of active exploitation signals.

An attacker crafts a malicious shortcut file and delivers it to a macOS user running a vulnerable Chrome version via email attachment, web download, or a shared document. When the user opens the file, Chrome's Shortcuts component processes the untrusted input without adequate validation, allowing the attacker to bypass navigation restrictions and redirect the user to a URL that Chrome would otherwise block - such as a phishing page filtered by SafeBrowsing or a restricted internal resource. No public exploit identified at time of analysis, and the attack cannot be automated without user interaction.