CVE-2026-11691
LowCVSS 3.1Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
Insufficient validation of untrusted input in the New Tab Page in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
Risk Assessment
The organization is at risk of cross-origin data leakage in Chrome, potentially leading to disclosure of sensitive user information.
Recommendation
Update Google Chrome to version 149.0.7827.103 or later, which includes the fix.
Original NVD description (English source)
Insufficient validation of untrusted input in New Tab Page in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)