Google Chrome CVE-2026-11675

The critical prerequisite is a prior compromise of the Chrome renderer process - this CVE is not independently exploitable by a remote attacker against an uncompromised browser. The renderer compromise must come from a separate vulnerability. Beyond that, the attacker must induce user interaction (UI:R): the victim must navigate to or load a crafted HTML page. Attack complexity is rated High (AC:H), consistent with the renderer pre-compromise requirement. Exploitation is therefore limited to: (1) attackers who have already succeeded in a renderer-level exploit, (2) victims who interact with attacker-controlled content, and (3) Chrome desktop versions below 149.0.7827.103. There is no requirement for any non-default Chrome configuration - but the renderer pre-compromise is the decisive gating factor that makes mass exploitation implausible.

The CVSS 3.1 base score of 3.1 (Low) is well-calibrated to the realistic threat. The vector AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N reveals several limiting factors: high attack complexity (AC:H) due to the renderer pre-compromise requirement, mandatory user interaction (UI:R) requiring victim engagement with a crafted page, no integrity or availability impact, and limited confidentiality impact (C:L). SSVC corroborates this - exploitation is confirmed as none, the attack is not automatable, and technical impact is only partial. No EPSS score was provided in the input data, so probability-of-exploitation figures cannot be cited. There is no CISA KEV listing and no public exploit identified. Cross-referencing all signals, this CVE represents a low real-world priority: it is a data-leakage primitive useful only as a component of a sophisticated multi-stage attack chain, not a standalone exploitable condition. Defenders should patch on their standard Chrome update cadence rather than treating this as an emergency.

An attacker who has already achieved code execution within a Chrome renderer process - via a separate, more severe vulnerability - delivers a crafted HTML page containing malicious graphical content that triggers the out-of-bounds read in Skia. The memory contents exposed by the read leak cross-origin data (e.g., content from another site's renderer) that would otherwise be protected by Chrome's same-origin policy. No public exploit code exists at time of analysis, and this scenario requires chaining at minimum two vulnerabilities.