CVE Catalog
CVE-2026-11686
LowCVSS 3.1Exploitation Probability (EPSS)
Low risk0.17%
7th percentile - higher than 7% of all known CVEs
Summary
Insufficient validation of untrusted input in the Dawn component in Google Chrome on macOS prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page.
Risk Assessment
An attacker can steal sensitive data from other origins, breaking cross-origin isolation in the browser.
Recommendation
Update Google Chrome to version 149.0.7827.103 or later.
Original NVD description (English source)
Insufficient validation of untrusted input in Dawn in Google Chrome on macOS prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)