Google Chrome CVE-2026-11684

Exploitation requires two mandatory preconditions: (1) the attacker must have already compromised the Google Chrome utility process through a separate, independent vulnerability - this is the dominant limiting factor and makes this a chained, second-stage attack rather than a standalone exploit; and (2) user interaction is required (UI:R), meaning the victim must visit or be redirected to a crafted HTML page controlled by the attacker. The CVSS vector PR:N indicates no privileges are required on the attacker's side, but the pre-compromised utility process is effectively an elevated prerequisite not captured by the PR dimension alone. Exploitation is limited to confidentiality impact only (no code execution, no integrity or availability effects). The attack is not automatable per SSVC (Automatable: no), further restricting mass exploitation scenarios. Scope is unchanged (S:U), meaning the attacker cannot pivot beyond the Chrome browser context.

The CVSS 3.1 score of 3.1 (Low) accurately reflects the constrained real-world risk. The vector AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N reveals multiple limiting factors: high attack complexity (AC:H) due to the requirement that the utility process be independently compromised beforehand, mandatory user interaction (UI:R) requiring a victim to load a crafted page, and only partial confidentiality impact with no integrity or availability consequences. SSVC assessment corroborates this: Exploitation=none, Automatable=no, Technical Impact=partial. This is a chained vulnerability - it is not independently exploitable but rather a second-stage information disclosure that amplifies an existing compromise. EPSS score is not provided in the available data. There is no conflict between the CVSS vector signals and the vulnerability description; both consistently indicate this is a low-priority, constrained disclosure issue rather than a primary attack surface. CVE is not listed in CISA KEV.

An attacker who has already achieved compromise of the Chrome utility process - through a separate, unrelated vulnerability - then serves the victim a crafted HTML page that triggers the insufficient network policy enforcement. When the victim visits the page, the compromised utility process bypasses cross-origin data isolation, allowing the attacker to exfiltrate limited cross-origin data such as response bodies or headers from other origins the victim is authenticated to. No public exploit code exists at time of analysis.