Google Chrome CVE-2026-11685

Exploitation requires that the victim is running Google Chrome on macOS at a version prior to 149.0.7827.103 - Windows and Linux users are not affected by this CVE. The CVSS UI:R designation confirms that user interaction is mandatory: the victim must visit an attacker-controlled or attacker-influenced HTML page during an active browsing session. Because PR:N is set in the CVSS vector, no authentication to any service is required on the attacker's side. The attack does not require a privileged network position (no AitM/MitM needed) - any page reachable via a normal browser request qualifies as the delivery mechanism. Exploitation is limited by: the Mac-only platform scope, the requirement for active user browsing to a malicious page, and the low confidentiality impact ceiling (C:L), which bounds the data exposure to partial cross-origin information rather than full account takeover.

The CVSS 4.3 Medium score reflects a realistic but bounded threat: the attack vector is network (AV:N) with low complexity (AC:L), no privileges required (PR:N), but mandatory user interaction (UI:R), and the scope is unchanged (S:U) with only low confidentiality impact (C:L) and no integrity or availability impact. EPSS data was not provided in the input; without it, exploitation probability cannot be quantified beyond the CVSS signal. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, and no public proof-of-concept code has been identified, further lowering operational urgency. The primary limiting factor is the UI:R requirement - exploitation depends on a victim actively visiting an attacker-controlled or attacker-influenced page - making mass automated exploitation unlikely. However, in targeted scenarios (phishing, malicious ad, compromised site), this bar is easily cleared for motivated adversaries. The Mac-only scope reduces the aggregate exposed population. Overall, this is a genuine but lower-priority information disclosure issue: patch promptly as part of routine browser update cadence rather than treating it as an emergency.

An attacker hosts or injects a crafted HTML page that invokes the MediaCapture API in a manner that exploits the improper input validation flaw, causing Chrome on Mac to inadvertently expose data from a cross-origin context (e.g., contents of a page the victim has open in another tab or authenticated session data). The attacker delivers the page to the victim via a phishing email link, malicious advertisement, or compromised third-party site. No public proof-of-concept is currently known, meaning active exploitation would require independent rediscovery of the technique, though the Chromium issue tracker entry (https://issues.chromium.org/issues/517183713) may contain technical details that reduce that bar.