CVE-2026-11244
LowCVSS 3.1Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
Vulnerability in Google Chrome prior to version 149.0.7827.53. Insufficient input validation in WebAuthentication allows an attacker who compromised the renderer process to bypass same origin policy via a crafted HTML page.
Risk Assessment
The risk is the possibility of bypassing same origin policy, which could lead to data theft or unauthorized actions in the context of another site.
Recommendation
It is recommended to update Google Chrome to version 149.0.7827.53 or later.
Original NVD description (English source)
Insufficient validation of untrusted input in WebAuthentication in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page. (Chromium security severity: Low)