CVE-2026-11258: Google Chrome Auth Bypass Vulnerability

CVE-2026-11258 Overview

CVE-2026-11258 affects Google Chrome versions prior to 149.0.7827.53. The flaw resides in the File System Access API implementation. A remote attacker who convinces a user to perform specific user interface gestures can bypass discretionary access control through a crafted HTML page. The weakness is categorized under [CWE-284] Improper Access Control. Chromium rates the security severity as Low, while NVD scores it 6.5 (Medium).

Critical Impact
Successful exploitation allows attackers to bypass file access restrictions in the browser, potentially modifying files outside the scope intended by the user during a File System Access prompt.

Affected Products

Google Chrome versions prior to 149.0.7827.53
Microsoft Windows installations running affected Chrome builds
Apple macOS and Linux installations running affected Chrome builds

Discovery Timeline

2026-06-05 - CVE-2026-11258 published to NVD
2026-06-08 - Last updated in NVD database

Technical Details for CVE-2026-11258

Vulnerability Analysis

The vulnerability stems from an inappropriate implementation within Chrome's File System Access feature. This API allows web pages to read or modify files and directories on the user's device after the user grants permission through a browser dialog. The flaw breaks the discretionary access control model that the API is designed to enforce.

Attackers exploit the flaw by hosting a crafted HTML page and convincing the victim to perform specific UI gestures. These gestures interact with the File System Access permission flow in a way that bypasses the intended scope of granted access. User interaction is required, which limits drive-by exploitation but remains feasible through social engineering.

The integrity impact is high because the bypass can lead to unauthorized file modification, while confidentiality and availability are not directly affected according to the published vector. The defect is tracked in the Chromium issue tracker under entry 499078161.

Root Cause

The root cause is improper enforcement of access boundaries in the File System Access API. Permission checks fail to account for a specific sequence of UI interactions, allowing the page to act outside the scope the user authorized. This is a logic and access control defect, not a memory corruption issue.

Attack Vector

Exploitation requires the victim to visit a malicious or compromised web page and complete a specific gesture sequence. No authentication or privileges are required on the target system. Because the gestures must be performed manually, attackers typically rely on phishing pages or deceptive web content to lure users.

No verified proof-of-concept code is published. Technical details are described in prose only; refer to the Chromium Issue Tracker Entry for additional context.

Detection Methods for CVE-2026-11258

Indicators of Compromise

Chrome browser processes spawning unexpected file write operations following a visit to an untrusted domain.
Renderer activity that correlates with showOpenFilePicker, showSaveFilePicker, or showDirectoryPicker invocations on suspicious origins.
Browser telemetry showing File System Access permission grants immediately followed by file modifications outside the user's documents workflow.

Detection Strategies

Inventory Chrome installations and flag any host running a version below 149.0.7827.53.
Inspect proxy and DNS logs for traffic to domains hosting unusual HTML content that interacts with the File System Access API.
Correlate browser child-process file activity with web navigation events to surface anomalous write patterns.

Monitoring Recommendations

Enable browser endpoint telemetry to capture file write events from chrome.exe and equivalent binaries on macOS and Linux.
Alert on Chrome processes modifying files in sensitive directories such as user profile, startup, or shared network paths shortly after web navigation.
Track Chrome version compliance through endpoint management systems and remediate stragglers continuously.

How to Mitigate CVE-2026-11258

Immediate Actions Required

Update Google Chrome to version 149.0.7827.53 or later on Windows, macOS, and Linux endpoints.
Verify that auto-update is enabled and functioning across the fleet; restart Chrome to apply pending updates.
Communicate to users the risk of granting File System Access permissions on untrusted sites.

Patch Information

Google released the fix in the Chrome Stable channel update documented in the Google Chrome Update Announcement. Administrators should confirm deployed versions match or exceed 149.0.7827.53. Chromium-based browsers that inherit the same code should apply equivalent updates as their vendors publish them.

Workarounds

Restrict the File System Access API through enterprise policy by configuring DefaultFileSystemReadGuardSetting and DefaultFileSystemWriteGuardSetting to block by default.
Use the FileSystemReadBlockedForUrls and FileSystemWriteBlockedForUrls policies to deny access on all origins until patching is complete.
Educate users to decline File System Access prompts on unfamiliar websites and to avoid unsolicited gesture sequences such as clicking through multiple dialogs.

bash

# Configuration example: Chrome enterprise policy to disable File System Access by default
# Windows registry path: HKLM\Software\Policies\Google\Chrome
#
#   DefaultFileSystemReadGuardSetting  = 2   (BlockFileSystemRead)
#   DefaultFileSystemWriteGuardSetting = 2   (BlockFileSystemWrite)
#
# macOS plist: /Library/Preferences/com.google.Chrome.plist
defaults write com.google.Chrome DefaultFileSystemReadGuardSetting -int 2
defaults write com.google.Chrome DefaultFileSystemWriteGuardSetting -int 2

# Linux managed policy: /etc/opt/chrome/policies/managed/file_system_access.json
# {
#   "DefaultFileSystemReadGuardSetting": 2,
#   "DefaultFileSystemWriteGuardSetting": 2
# }