CVE-2026-11242

Insufficient validation of untrusted input in Google Chrome plugins allowed a remote attacker who had compromised the renderer process to craft a malicious HTML page that could read data from higher privilege origins. The result is the leakage of sensitive information across site boundaries, constituting a data exposure vulnerability rooted in improper input validation (CWE‑20) and insufficient bounds checking (CWE‑1173).

Google Chrome versions prior to 149.0.7827.53 are vulnerable. Users or organizations whose Chrome installations have not yet been updated to the patched release are at risk of cross‑origin data leakage if they run the affected plugin engine.

The CVSS score is 7.5 and the EPSS score is less than 1%, indicating a moderate‑severity flaw with a low likelihood of exploitation, yet the overall risk remains somewhat unclear from publicly available metrics. The vulnerability is not listed in the CISA KEV catalog, indicating that no widely known, actively exploited exploits have been documented. Attackers would need to compromise the renderer process, which typically requires local code execution or exploitation of another plugin, so the attack vector is not trivially reachable from a remote connection. However, if such compromise occurs, the ability to read sensitive, cross‑origin data could be abused for credential theft or privacy violations. Given the information, the likelihood of exploitation is moderate but not negligible, and the potential impact is significant if the attacker gains access to the affected Chrome instance.