CVE-2026-11273: Google Chrome XSS Vulnerability

CVE-2026-11273 Overview

CVE-2026-11273 is a Universal Cross-Site Scripting (UXSS) vulnerability in the Omnibox component of Google Chrome. The flaw stems from insufficient validation of untrusted input and affects all Chrome versions prior to 149.0.7827.53. A remote attacker can inject arbitrary scripts or HTML through a crafted HTML page, but exploitation requires the victim to perform specific UI gestures. The issue is tracked under [CWE-20: Improper Input Validation] and impacts Chrome on Windows, macOS, and Linux. Google rated the Chromium security severity as Low, while the assigned CVSS 3.1 score is 6.1.

Critical Impact
Successful exploitation allows attackers to execute arbitrary JavaScript or HTML in the context of other origins, bypassing the same-origin policy and enabling theft of session data, credentials, or sensitive page content.

Affected Products

Google Chrome prior to 149.0.7827.53 on Microsoft Windows
Google Chrome prior to 149.0.7827.53 on Apple macOS
Google Chrome prior to 149.0.7827.53 on Linux

Discovery Timeline

2026-06-05 - CVE-2026-11273 published to NVD
2026-06-08 - Last updated in NVD database

Technical Details for CVE-2026-11273

Vulnerability Analysis

The Omnibox is Chrome's combined address and search bar that parses user input, suggested URLs, and search queries. CVE-2026-11273 occurs because the Omnibox does not sufficiently validate untrusted input before rendering or navigating to it. An attacker who controls page content can craft input that the Omnibox processes unsafely, leading to Universal Cross-Site Scripting (UXSS).

Unlike standard reflected XSS, a UXSS flaw lives in the browser itself. Injected script can run against any origin the victim visits, breaking the same-origin policy that isolates websites from one another. The attacker can read cookies, exfiltrate authenticated session data, or modify page behavior on banking, mail, or enterprise applications.

Exploitation requires user interaction. The attacker must convince the victim to perform specific UI gestures — for example, dragging content into the Omnibox, clicking a crafted link, or interacting with a malicious page element. This user-interaction requirement is reflected in the CVSS vector (UI:R) and is why Google rated the Chromium severity as Low despite the cross-origin impact.

Root Cause

The root cause is improper input validation [CWE-20] in the Omnibox input-handling logic. The component accepts attacker-influenced data and passes it through a path that ultimately permits script or HTML interpretation in a privileged or cross-origin context. Details are tracked in the Chromium Issue Tracker Entry.

Attack Vector

The attack is network-based. An attacker hosts a crafted HTML page and lures the victim to visit it. The page is designed to trick the user into a specific Omnibox interaction, such as dragging text, dropping a link, or copying attacker-controlled content into the address bar. When the gesture completes, the malicious payload is processed by the Omnibox and executed in a context that violates origin isolation.

No verified public proof-of-concept code is available at the time of publication. The vulnerability mechanism is described in the Google Chrome Stable Update advisory.

Detection Methods for CVE-2026-11273

Indicators of Compromise

Browser telemetry showing Chrome versions older than 149.0.7827.53 after the patch release window
Unexpected JavaScript execution or DOM modification on sensitive web applications visited shortly after user interaction with external links
Outbound HTTP requests from browser sessions containing session cookies or tokens sent to attacker-controlled domains
Web proxy logs showing visits to unknown HTML pages immediately preceding anomalous authenticated activity

Detection Strategies

Inventory Chrome installations across managed endpoints and flag any host running a version below 149.0.7827.53
Monitor endpoint process telemetry for Chrome child processes spawning unusual content or navigating to attacker-controlled URLs after drag-and-drop gestures
Correlate web gateway logs with endpoint browsing activity to identify users visiting newly registered or low-reputation HTML pages

Monitoring Recommendations

Enable enterprise Chrome reporting through Chrome Browser Cloud Management to track version compliance
Alert on successful authentication events from sessions where the preceding browser activity included untrusted external sites
Review SIEM data for anomalous cross-origin requests originating from user endpoints during the exposure window

How to Mitigate CVE-2026-11273

Immediate Actions Required

Update Google Chrome to version 149.0.7827.53 or later on all Windows, macOS, and Linux endpoints
Force-restart Chrome browsers after deployment to ensure the patched binary is loaded
Verify version compliance using enterprise management tooling and remediate stragglers
Educate users to avoid dragging or pasting content from untrusted pages into the address bar

Patch Information

Google released the fix in the Chrome Stable channel as version 149.0.7827.53. Refer to the Google Chrome Stable Update advisory for the full list of fixes included in this release. Chromium-based browsers such as Microsoft Edge, Brave, and Opera typically inherit the fix in subsequent releases; verify each vendor's advisory.

Workarounds

No vendor-supplied workaround exists; apply the update as the primary remediation
Restrict access to untrusted websites through web filtering until patch deployment completes
Disable or restrict Chrome extensions that automate Omnibox interactions on managed devices
Use enterprise policies to enforce automatic Chrome updates and prevent users from deferring restarts

bash

# Verify installed Chrome version on Linux/macOS
google-chrome --version

# Windows: query registry for installed Chrome version
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version

# Enforce auto-update via Chrome Enterprise policy (Linux example)
# /etc/opt/chrome/policies/managed/auto_update.json
# {
#   "AutoUpdateCheckPeriodMinutes": 60,
#   "DefaultBrowserSettingEnabled": true
# }