CVE-2026-11245: Google Chrome XSS Vulnerability

CVE-2026-11245 Overview

CVE-2026-11245 is a user interface (UI) spoofing vulnerability in the Payments component of Google Chrome prior to version 149.0.7827.53. A remote attacker can craft an HTML page that misrepresents payment-related UI elements, deceiving users into trusting falsified content. The flaw is classified under [CWE-451] (User Interface Misrepresentation of Critical Information) and affects Chrome installations on Windows, macOS, and Linux.

Exploitation requires user interaction, such as visiting an attacker-controlled web page. Chromium rates the underlying issue as Low severity, while the National Vulnerability Database assigns a CVSS 3.1 base score of 4.3.

Critical Impact
A remote attacker can spoof payment UI elements via a crafted HTML page, potentially deceiving users into authorizing fraudulent transactions or disclosing payment information.

Affected Products

Google Chrome versions prior to 149.0.7827.53
Chrome desktop builds on Microsoft Windows, Apple macOS, and Linux
Chromium-based browser deployments embedding the affected Payments component

Discovery Timeline

2026-06-05 - CVE-2026-11245 published to the National Vulnerability Database
2026-06-05 - Google publishes the Stable Channel desktop update advisory
2026-06-05 - Last updated in NVD database

Technical Details for CVE-2026-11245

Vulnerability Analysis

The flaw resides in the Payments subsystem of Google Chrome, which renders payment request prompts and related transactional UI surfaces. An inappropriate implementation in this component allows attacker-controlled HTML to influence how payment information is presented to the user. The resulting UI spoofing condition enables a malicious page to present payment dialogs, origin indicators, or transactional context that does not accurately reflect the underlying request.

UI spoofing weaknesses in browser payment flows undermine the trust boundary between the renderer and security-critical chrome surfaces. When that boundary blurs, users cannot reliably distinguish legitimate merchant requests from attacker-controlled overlays. Successful exploitation may lead to disclosure of payment instrument details or approval of unintended transactions. Confidentiality and integrity impact are limited under CVSS scoring, and no availability impact is reported.

Root Cause

The root cause is an inappropriate implementation within the Payments code path, mapped to [CWE-451]. The component does not adequately constrain how attacker-supplied HTML content interacts with payment UI rendering, allowing visually deceptive overlays or misrepresented origin information. Full technical specifics are tracked in the Chromium Issue Tracker Entry.

Attack Vector

Exploitation occurs over the network through a crafted HTML page. The attacker must convince a target user to visit the malicious site or load attacker-controlled content within an embedded context. No authentication or elevated privileges are required, but user interaction is necessary because the attack depends on the victim engaging with the spoofed payment surface. No public proof-of-concept exploit, ExploitDB entry, or CISA Known Exploited Vulnerabilities listing exists for this issue.

Detection Methods for CVE-2026-11245

Indicators of Compromise

Outbound browser navigation to newly registered or low-reputation domains that host payment-themed HTML content.
Endpoint telemetry showing Chrome processes below version 149.0.7827.53 rendering payment request flows from untrusted origins.
User reports of mismatched merchant names, prices, or origin indicators inside Chrome payment prompts.

Detection Strategies

Inventory installed Chrome builds across managed endpoints and flag any version earlier than 149.0.7827.53.
Correlate web proxy and DNS logs with phishing or payment-themed lure domains targeting users immediately before financial transactions.
Hunt for HTML responses containing Payment Request API invocations served from domains outside an approved merchant allowlist.

Monitoring Recommendations

Ingest browser version telemetry into the SIEM and alert when out-of-date Chrome instances launch payment workflows.
Monitor user-reported phishing submissions for payment-spoofing patterns aligned with this Chromium issue.
Track Google's Stable Channel release notes for follow-up advisories or related Payments fixes.

How to Mitigate CVE-2026-11245

Immediate Actions Required

Update Google Chrome to version 149.0.7827.53 or later on all Windows, macOS, and Linux endpoints.
Force-restart Chrome after deployment to ensure the patched binary replaces running renderer and browser processes.
Validate enterprise policy enforcement so that auto-update is enabled and cannot be disabled by end users.

Patch Information

Google addressed CVE-2026-11245 in the Chrome Stable Channel desktop update referenced in the Google Chrome Desktop Update advisory. Administrators should deploy Chrome 149.0.7827.53 or later through their standard software distribution mechanism. Chromium-derived browsers should pick up the upstream fix in their next aligned release.

Workarounds

Train users to verify merchant origin and amount within Chrome payment prompts before confirming transactions.
Restrict access to high-risk or uncategorized web destinations through a secure web gateway until patching completes.
Disable the Payment Request API via enterprise policy where business workflows do not require browser-mediated payments.

bash

# Verify installed Chrome version on Linux/macOS endpoints
google-chrome --version

# Windows: query installed Chrome version via registry
reg query "HKLM\Software\Google\Chrome\BLBeacon" /v version

# Example Chrome enterprise policy to enforce auto-update (Windows registry)
reg add "HKLM\Software\Policies\Google\Update" /v UpdateDefault /t REG_DWORD /d 1 /f