CVE-2026-11267: Google Chrome Auth Bypass Vulnerability

CVE-2026-11267 Overview

CVE-2026-11267 is a content security policy bypass in the Extensions component of Google Chrome prior to version 149.0.7827.53. The flaw stems from insufficient policy enforcement, allowing a crafted Chrome Extension to circumvent Content Security Policy (CSP) restrictions. An attacker must convince a user to install a malicious extension to trigger the issue. Google rated the Chromium security severity as Low, and the vulnerability is tracked under [CWE-602] for client-side enforcement of server-side security. The issue affects Chrome on Windows, macOS, and Linux. Google addressed the defect in the Stable channel desktop update published on the Chrome Releases blog.

Critical Impact
A malicious extension can bypass CSP protections in the browser, weakening defenses against script injection and data exfiltration on visited sites.

Affected Products

Google Chrome prior to 149.0.7827.53 on Microsoft Windows
Google Chrome prior to 149.0.7827.53 on Apple macOS
Google Chrome prior to 149.0.7827.53 on Linux

Discovery Timeline

2026-06-05 - CVE-2026-11267 published to NVD
2026-06-08 - Last updated in NVD database

Technical Details for CVE-2026-11267

Vulnerability Analysis

The vulnerability resides in how Chrome's Extensions subsystem enforces Content Security Policy on extension-driven page interactions. Insufficient enforcement allows a specially crafted extension to evade CSP directives that normally restrict script sources, inline execution, and connection targets. Successful exploitation does not yield code execution on the host system. Instead, it weakens an integrity boundary that web applications rely on, enabling secondary attacks such as script injection into otherwise CSP-protected pages. User interaction is required because the attacker must first persuade the victim to install the malicious extension from a distribution channel.

Root Cause

The defect maps to [CWE-602], Client-Side Enforcement of Server-Side Security. Chrome's extension runtime fails to consistently apply CSP directives declared by the underlying web page when extension-controlled content or APIs interact with the document. The result is that policy decisions that should be authoritative are inconsistently honored, leaving an enforcement gap that a tailored manifest and content script can exploit.

Attack Vector

The attack chain begins with social engineering. The attacker publishes or sideloads an extension and convinces the victim to install it. Once active, the extension issues crafted DOM operations or API calls that the browser processes without applying the expected CSP. The attacker can then load disallowed script sources, exfiltrate page data, or tamper with site integrity inside the user's session. No network privilege or authentication bypass on the target site is required. See the Chromium Issue Tracker Entry for technical context.

Detection Methods for CVE-2026-11267

Indicators of Compromise

Installation of Chrome extensions from outside the enterprise allowlist or from sideloaded .crx files.
Extensions declaring broad host permissions (<all_urls>) combined with content scripts that manipulate CSP-sensitive elements.
Outbound connections from browser processes to domains not referenced by visited sites' CSP allowlists.

Detection Strategies

Inventory installed extensions across managed endpoints and compare against an approved list maintained in Chrome Enterprise policy.
Hunt for browser child processes spawning unexpected network connections following recent extension installation events.
Review the Google Chrome Update Announcement and confirm deployed Chrome versions are at or above 149.0.7827.53.

Monitoring Recommendations

Forward Chrome ExtensionInstallEvent and ExtensionUninstallEvent telemetry from managed devices to a central log store for review.
Alert on registry or preference changes under Chrome extension paths on Windows, macOS, and Linux endpoints.
Monitor for users disabling enterprise extension policies or switching to developer mode.

How to Mitigate CVE-2026-11267

Immediate Actions Required

Update Google Chrome to version 149.0.7827.53 or later on all Windows, macOS, and Linux endpoints.
Audit installed extensions and remove any that are unsigned, sideloaded, or not on the approved list.
Enforce Chrome Enterprise policies that block installation from sources outside the Chrome Web Store.

Patch Information

Google released the fix in the Stable channel desktop update for Chrome 149.0.7827.53. Distribution and release notes are documented in the Google Chrome Update Announcement. The underlying issue is tracked in the Chromium Issue Tracker Entry.

Workarounds

Configure the ExtensionInstallBlocklist policy with * and use ExtensionInstallAllowlist to permit only vetted extension IDs.
Disable developer mode for extensions on managed endpoints to prevent unpacked extension loading.
Educate users to install extensions only from verified publishers through the Chrome Web Store.

bash

# Configuration example - Chrome Enterprise policy (Windows registry)
reg add "HKLM\Software\Policies\Google\Chrome\ExtensionInstallBlocklist" /v 1 /t REG_SZ /d "*" /f
reg add "HKLM\Software\Policies\Google\Chrome\ExtensionInstallAllowlist" /v 1 /t REG_SZ /d "<approved-extension-id>" /f
reg add "HKLM\Software\Policies\Google\Chrome" /v DeveloperToolsAvailability /t REG_DWORD /d 2 /f