Google Chrome CVE-2026-11309

The victim must actively visit a crafted HTML page in Google Chrome (UI:R - user interaction required), which prevents automated or worm-like exploitation. The attacker requires no authentication (PR:N) and no elevated privileges on the target system. The vulnerability is present in default Chrome installations with no special configuration required on the victim's side - any Chrome user below version 149.0.7827.53 browsing to a malicious page is potentially affected. Exploitation is limited to UI-level spoofing (no code execution, no data theft per CVSS C:N/A:N), which constrains the practical harm. The unchanged scope (S:U) means the exploit cannot pivot to the OS or other browser origins beyond the History manipulation itself.

The combined signal from all available intelligence sources places this vulnerability firmly in the low real-world priority tier. CVSS 4.3 is a Medium base score, but Chromium's own severity rating is 'Low,' which is consistent with the CVSS breakdown: no confidentiality impact, only low integrity impact, and no availability impact. EPSS at 0.03% (11th percentile) further confirms minimal exploitation probability in practice. There is no CISA KEV listing and no public exploit code identified. The UI:R requirement is a meaningful limiting factor - mass automated exploitation is not feasible since each victim must manually interact with a malicious page. One notable discrepancy: the CVE tag includes 'Information Disclosure,' but the CVSS vector explicitly shows C:N (no confidentiality impact); this tag likely reflects metadata classification noise and should not influence triage. The SSVC signal on automatable exploitation is low given the required user interaction.

An attacker crafts a malicious HTML page that exploits Chrome's History policy enforcement gap, then distributes a link via phishing email or a compromised advertisement network. When a user on a vulnerable Chrome version visits the page, the attacker manipulates the browser's displayed History or UI chrome elements (such as the address bar state or back/forward navigation context) to impersonate a trusted site, enabling a follow-on phishing step where the victim enters credentials or approves an action believing they are on a legitimate domain. No public proof-of-concept code exists at time of analysis.