CVE-2026-11267
MediumCVSS 4.3Summary
Insufficient policy enforcement in Extensions in Google Chrome prior to version 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension to bypass content security policy via a crafted Chrome Extension.
Risk Assessment
The organization may be exposed to attacks that exploit malicious extensions to bypass security measures, potentially leading to data breaches or malware.
Recommendation
It is recommended to update Google Chrome to the latest version to minimize the risk associated with this vulnerability and to monitor installed extensions.
Original NVD description (English source)
Insufficient policy enforcement in Extensions in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension to bypass content security policy via a crafted Chrome Extension. (Chromium security severity: Low)