Google Chrome CVE-2026-11300

The victim must visit an attacker-controlled or attacker-crafted HTML page using a vulnerable Chrome Desktop version prior to 149.0.7827.53 - user interaction is required (UI:R per CVSS vector). No authentication is required from the attacker's side (PR:N), and network complexity is low (AC:L), meaning no special network positioning is needed. Exploitation is limited by the mandatory user interaction: the attack cannot be triggered silently or autonomously. SSVC additionally confirms the vulnerability is not automatable. The attack is constrained to integrity impact only (I:L) - no data exfiltration or service disruption is achievable through this vulnerability alone.

All available risk signals converge on low priority. The CVSS 4.3 base score reflects AV:N/AC:L/PR:N/UI:R with S:U and no confidentiality or availability impact - only low integrity impact. The mandatory user interaction (UI:R) and unchanged scope (S:U) constrain the attack surface significantly. EPSS at 0.03% (8th percentile) indicates this vulnerability is extremely unlikely to be exploited in the near term relative to the broader CVE population. SSVC confirms exploitation status as none and marks the vulnerability as non-automatable with only partial technical impact. There is no CISA KEV listing and no publicly available exploit code. The vendor itself rates severity as Low. No conflicting signals exist between sources - this is a consistent low-risk profile warranting inclusion in the next standard patch cycle rather than emergency remediation.

An attacker hosts a crafted HTML page designed to manipulate Chrome's Permissions UI rendering, then lures a target user to visit it via phishing, malvertising, or a compromised link. When the victim loads the page, the permissions interface is spoofed - for example, presenting a false indicator that a sensitive permission has been denied when it has actually been granted, or vice versa - potentially leading the user to make an incorrect security decision. No public proof-of-concept exists at time of analysis, and the user must actively navigate to the attacker-controlled page for the attack to succeed.