Google Chrome CVE-2026-11668

The victim must be running Google Chrome on Linux or ChromeOS (Windows and macOS are not listed as affected - this is a platform-scoped vulnerability). The victim must actively open or load a crafted video file, either by visiting a malicious web page that embeds or streams the video, or by directly opening a downloaded video file in Chrome (UI:R per CVSS vector). No authentication is required from the attacker side (PR:N), and no non-default configuration is needed - any Linux or ChromeOS Chrome installation below 149.0.7827.103 processing video content is potentially at risk. Exploitation is limited by: mandatory user interaction to trigger video processing, platform restriction to Linux/ChromeOS only, and the partial/limited nature of the cross-origin data disclosure (C:L), which constrains the attacker's ability to extract targeted high-value data reliably.

The CVSS 3.1 base score of 4.3 (Medium) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N accurately reflects a moderate, bounded risk profile. Attack vector is Network with low complexity, meaning no special network position is required, but exploitation is not automatable because it requires a victim to actively interact with a crafted video file (UI:R). The scope is unchanged (S:U), integrity and availability are unaffected, and confidentiality impact is limited (C:L), consistent with a partial cross-origin data leak rather than full credential or session exfiltration. The CISA SSVC assessment reinforces this: exploitation is 'none', the attack is not automatable, and technical impact is 'partial'. No EPSS score was provided in the input data, so quantitative exploitation probability cannot be cited. The vulnerability is not listed in CISA KEV, and no public POC has been identified - this is not a confirmed in-the-wild threat at time of analysis. Overall, while the network-reachable, zero-privilege-required attack surface is a concern, the mandatory user interaction, limited confidentiality impact, and absence of active exploitation indicators place this as a patch-cycle priority rather than an emergency response item.

An attacker hosts a malicious web page embedding a specially crafted video file designed to trigger the uninitialized codec memory path in Chrome on Linux or ChromeOS. When a targeted user visits the page and the video begins processing, residual cross-origin memory contents are exposed to the attacker-controlled context and exfiltrated - potentially including fragments of data from other open tabs or prior codec operations. No public POC exists at time of analysis, but the attack requires only convincing a user to visit a URL, making phishing-style delivery the most plausible vector.