CVE-2026-11265: Google Chrome Information Disclosure Flaw

CVE-2026-11265 Overview

CVE-2026-11265 is an inappropriate implementation vulnerability in the Autofill component of Google Chrome prior to version 149.0.7827.53. A remote attacker can leak cross-origin data by serving a crafted HTML page to a target user. The flaw is associated with [CWE-352] and stems from improper enforcement of origin boundaries within Autofill behavior.

The issue affects Chrome on Windows, macOS, and Linux. Google rates the Chromium security severity as Low, while the NVD assigns a higher CVSSv3.1 base score reflecting the confidentiality impact across the network attack vector with no privileges or user interaction required.

Critical Impact
Remote attackers can exfiltrate cross-origin data from victim browsers by enticing users to visit a malicious HTML page, undermining the same-origin policy that protects sensitive web application data.

Affected Products

Google Chrome prior to 149.0.7827.53
Google Chrome on Microsoft Windows
Google Chrome on Apple macOS and Linux

Discovery Timeline

2026-06-05 - CVE-2026-11265 published to the National Vulnerability Database
2026-06-08 - CVE-2026-11265 last modified in NVD database

Technical Details for CVE-2026-11265

Vulnerability Analysis

The vulnerability resides in Chrome's Autofill subsystem, which manages saved form data such as addresses, payment information, and other user-entered values. Autofill must strictly enforce origin boundaries so that data stored or rendered for one site cannot be observed by another. The inappropriate implementation in versions prior to 149.0.7827.53 breaks that guarantee.

An attacker who controls a web page can craft HTML that interacts with Autofill in a way that exposes information associated with a different origin. The Chromium issue tracker entry, Chromium Issue 500262869, tracks the underlying defect and corresponding fix.

The impact is limited to confidentiality. The flaw does not provide code execution, persistence, or write access to victim data. However, leaked autofill values can include personally identifiable information (PII), addresses, and partial payment metadata.

Root Cause

The root cause is improper cross-origin isolation in Autofill logic, mapped to [CWE-352]. Autofill state intended for one origin is reachable from script or DOM constructs hosted on an attacker-controlled origin. The fix shipped in Chrome 149.0.7827.53 enforces stricter origin checks when handling Autofill suggestions and form interactions.

Attack Vector

Exploitation requires only that the victim visit a malicious or compromised web page. No authentication, prompts, or extension installation are needed. The attacker hosts a crafted HTML document that triggers the Autofill misbehavior and harvests cross-origin values through DOM observation or scripted form manipulation. Public proof-of-concept code is not available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

No verified exploit code is publicly available. See the Google Chrome Stable Channel Update for vendor details.

Detection Methods for CVE-2026-11265

Indicators of Compromise

Chrome browser instances reporting a version string below 149.0.7827.53 in endpoint inventory data.
Outbound HTTP/HTTPS POST traffic from browsers to untrusted domains containing form-shaped payloads with values the user did not type on that page.
Browser telemetry showing Autofill suggestions presented on unexpected or low-reputation origins.

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag any build older than 149.0.7827.53.
Correlate web proxy logs with threat intelligence to identify user navigation to newly registered or low-reputation domains delivering suspicious HTML forms.
Hunt for anomalous DOM iframe and form combinations in browser extension telemetry, where available, that align with known Autofill abuse patterns.

Monitoring Recommendations

Continuously monitor Chrome version drift through endpoint management or EDR inventory data and alert on stale versions.
Track DNS and web proxy egress for sessions involving long-lived HTML pages that submit form data to third-party origins.
Review enterprise password manager and Autofill policy enforcement to ensure cross-origin exposures are minimized.

How to Mitigate CVE-2026-11265

Immediate Actions Required

Update Google Chrome to version 149.0.7827.53 or later on all Windows, macOS, and Linux endpoints.
Force-restart browser sessions after deployment so the patched binary is loaded for every user.
Validate Chrome update channels are reaching all managed devices, including kiosks and remote endpoints.

Patch Information

Google released the fix in the Chrome Stable Channel update for desktop at version 149.0.7827.53. Refer to the Google Chrome Update Announcement and the Chromium Issue Tracker Entry for vendor-supplied details. Chromium-based browsers that incorporate the same Autofill component should also be updated when their vendors publish corresponding releases.

Workarounds

Disable Chrome Autofill for addresses and payment methods through enterprise policy until patched versions are deployed.
Restrict access to untrusted websites using web filtering or browser isolation for high-risk user groups.
Educate users to avoid interacting with forms on unfamiliar domains and to verify the origin before submitting saved data.

bash

# Verify Chrome version on Linux/macOS endpoints
google-chrome --version

# Windows: query installed version via PowerShell
(Get-Item "$env:ProgramFiles\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion

# Example enterprise policy to disable Autofill (Chrome policy JSON)
# Place under managed policies for Chrome
# {
#   "AutofillAddressEnabled": false,
#   "AutofillCreditCardEnabled": false
# }