CVE Catalog
CVE-2026-11684
LowCVSS 3.1Exploitation Probability (EPSS)
Low risk0.17%
7th percentile - higher than 7% of all known CVEs
Summary
Insufficient policy enforcement in the Network component in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the utility process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
Risk Assessment
An attacker can steal sensitive cross-origin data, potentially leading to a breach of user data confidentiality.
Recommendation
Immediately update Google Chrome to version 149.0.7827.103 or later.
Original NVD description (English source)
Insufficient policy enforcement in Network in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the utility process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)