Google Chrome CVE-2026-11292

Exploitation requires that the victim is running Google Chrome prior to version 149.0.7827.53 and interacts with (visits) an attacker-controlled or attacker-influenced HTML page - user interaction (UI:R) is a confirmed hard prerequisite per the CVSS vector, meaning drive-by exploitation without any user action is not possible. No attacker privileges or authentication are required (PR:N per CVSS). For the bypass to produce meaningful impact, the targeted web application must have a Content Security Policy in place; sites not deploying CSP are unaffected by this specific vulnerability. Attack complexity is Low (AC:L), requiring no special timing, race condition, or privileged network position beyond delivering the crafted page. Exploitation is strictly bounded to low integrity impact (I:L) - this vulnerability cannot independently achieve code execution, credential theft, or denial of service.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) scores this at 4.3 Medium, reflecting a network-reachable, low-complexity attack requiring no attacker privileges but mandating user interaction - the victim must navigate to a crafted page. The Unchanged scope and absence of confidentiality or availability impact further constrain the worst-case outcome to minor integrity violations. EPSS at 0.02% (4th percentile) is extremely low, indicating the security community has assessed near-negligible near-term exploitation likelihood. This vulnerability is not listed in CISA KEV, no public exploit code has been identified, and Chromium's own severity assessment is Low. The tag 'Authentication Bypass' in source data is potentially misleading - this is more precisely a client-side policy enforcement bypass, not a server-side authentication bypass. Real-world priority is low for most organizations; however, enterprises that rely heavily on CSP as a defense-in-depth layer against XSS in sensitive web applications should treat patching as a routine but prompt update cycle task.

An attacker registers or compromises a website and serves a crafted HTML page engineered to exploit the Blink CSP enforcement gap. A user running Chrome prior to 149.0.7827.53 is directed to this page - via phishing email, malicious advertisement, or a compromised legitimate site - and upon loading, the page bypasses CSP restrictions to load or execute unauthorized content within the browser context. No public exploit code has been identified at time of analysis, and the 0.02% EPSS score indicates this scenario has not materialized in observed threat activity.