Google Chrome CVE-2026-11299

Exploitation requires a victim running an unpatched Google Chrome desktop version (prior to 149.0.7827.53) to navigate to an attacker-controlled or attacker-influenced web page containing crafted HTML that exercises the Fonts rendering path (UI:R per CVSS vector). No authentication is required from the attacker's perspective (PR:N), and network complexity is rated Low (AC:L), meaning no race condition or special network position is needed. Exploitation is bounded by the mandatory user-interaction requirement - the attack cannot be delivered without the victim initiating a browser request, which SSVC confirms makes it non-automatable. The vulnerability is limited to information disclosure (I:N/A:N); code execution is not part of the impact. Chromium's internal Low severity classification suggests practical limits on the sensitivity or volume of memory reliably extractable. Note: the CVE description names 'integer overflow' as the mechanism while CWE-125 (Out-of-bounds Read) captures the observable consequence - both are consistent and describe the same exploit path.

The CVSS 6.5 Medium score (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) identifies a network-reachable, low-complexity attack that requires no privileges but does require user interaction, and yields a High confidentiality impact with no integrity or availability consequence. EPSS at 0.03% (11th percentile) is very low, strongly suggesting this vulnerability is not being actively targeted by exploit toolkits. SSVC corroborates this: Exploitation: none, Automatable: no, Technical Impact: partial - placing this in a deferred or scheduled remediation tier rather than an emergency response tier. No CISA KEV listing has been recorded. The Chromium team's own Low severity designation further indicates that practical exploitability or extractable data value is constrained relative to what the CVSS C:H rating alone might imply. Taken together, the signals are internally consistent: this is a real vulnerability with a credible memory-disclosure mechanism, but presents low real-world risk absent an active exploitation campaign. Standard patch-cycle remediation is appropriate.

An attacker registers or compromises a website and embeds a crafted HTML page containing malformed font data engineered to trigger the integer overflow in Chrome's Fonts component. When an unpatched victim navigates to the page - via a phishing link, malicious ad, or compromised legitimate site - Chrome's font renderer processes the malformed data, the integer overflow produces an out-of-bounds read, and memory fragments from the browser process are returned to the attacker, potentially exposing sensitive data resident in memory. No public exploit code has been identified at time of analysis, and the requirement for victim navigation prevents fully automated mass exploitation.