Google Chrome CVE-2026-11666

Exploitation requires the victim to actively navigate to an attacker-controlled URL in an unpatched version of Google Chrome desktop (prior to 149.0.7827.103) - user interaction (UI:R) is mandatory and cannot be bypassed remotely. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U) confirms the attack is network-accessible, requires no authentication or privileges from the attacker, and has low complexity once the victim visits the crafted page. No special Chrome configuration, extension, or server-side setting is required on the victim's machine - any unpatched Chrome desktop instance is potentially vulnerable by default. Exploitation is limited to Google Chrome desktop; the scope does not extend beyond the browser process (S:U), meaning sandbox escape is not part of this vulnerability. Users on Chrome 149.0.7827.103 or later, or using non-Chromium browsers, are not affected.

The CVSS 5.4 Medium score reflects network-accessible exploitation (AV:N) with no required privileges (PR:N) but mandatory user interaction (UI:R), limited to low confidentiality impact (C:L) and no integrity or availability impact (I:N/A:N from the vector, though A:L appears in the provided score vector - note a minor discrepancy between the 5.4 score and A:L component worth verifying with vendor). EPSS at 0.05% in the 15th percentile is exceptionally low, indicating the broader community has not observed meaningful exploitation attempts. The absence of a CISA KEV listing and any public POC further supports treating this as a routine patch-cycle vulnerability rather than an emergency. The realistic threat model is a phishing-adjacent scenario where a victim is lured to a malicious page - the mandatory UI:R requirement and unchanged scope (S:U) meaningfully bound blast radius. This is a real but low-urgency security fix; organizations with automated Chrome update policies are likely already protected.

An attacker registers or compromises a web domain, hosts a crafted HTML page that triggers Chrome's insufficient input validation to render spoofed browser UI elements - such as a fake security dialog, a fabricated address bar URL, or a spoofed permission prompt - and distributes the link via email or social media to targeted users. When the victim opens the link in an unpatched Chrome instance, the falsified UI deceives them into entering credentials, approving a malicious permission, or believing they are on a trusted site. No public proof-of-concept code has been identified at time of analysis, and the mandatory user navigation step (UI:R) is required for exploitation.