CVE-2026-11300: Google Chrome XSS Vulnerability

CVE-2026-11300 Overview

CVE-2026-11300 is a user interface (UI) spoofing vulnerability in the Permissions component of Google Chrome prior to version 149.0.7827.53. A remote attacker can craft a malicious HTML page that misrepresents permission prompts to the user. The flaw is classified under CWE-451: User Interface (UI) Misrepresentation of Critical Information. Successful exploitation requires user interaction with the crafted page. Chromium's internal severity rating for this issue is Low. The vulnerability affects Chrome on Windows, macOS, and Linux desktop platforms.

Critical Impact
A remote attacker can deceive users into granting unintended browser permissions through a spoofed Permissions UI on a crafted HTML page.

Affected Products

Google Chrome prior to 149.0.7827.53
Chrome on Microsoft Windows
Chrome on Apple macOS and Linux

Discovery Timeline

2026-06-05 - CVE-2026-11300 published to NVD
2026-06-08 - Last updated in NVD database

Technical Details for CVE-2026-11300

Vulnerability Analysis

The vulnerability resides in Chrome's Permissions subsystem, which governs prompts for access to capabilities such as geolocation, camera, microphone, notifications, and clipboard. An inappropriate implementation in this component allows a crafted HTML page to misrepresent the origin, purpose, or scope of a permission request. Users may then approve a permission grant believing it applies to a different site or capability.

The attack vector is network-based and requires user interaction. The impact is limited to integrity of the user interface, with no direct effect on confidentiality or availability of the browser process. Because the flaw operates within the renderer's permission UI flow, it does not produce memory corruption or arbitrary code execution.

The EPSS probability for this CVE is 0.021%, reflecting low observed interest from exploitation telemetry.

Root Cause

The root cause is improper rendering or validation of UI elements in the Permissions prompt path. Chromium tracks the underlying issue in the Chromium Issue Tracker entry 503614310. The fix shipped in the stable channel update for desktop documented in the Google Chrome Desktop Update advisory.

Attack Vector

An attacker hosts a malicious HTML page and lures a victim to visit it. The page manipulates the Permissions UI, for example by overlaying content, abusing navigation timing, or invoking permission requests in a context that obscures the true requesting origin. The user is induced to click an Allow control, granting a permission that the attacker can then leverage from the controlled origin.

No proof-of-concept code is publicly available for this issue, and no exploitation in the wild has been reported. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-11300

Indicators of Compromise

Chrome desktop installations reporting version strings earlier than 149.0.7827.53 in managed inventory.
Browser telemetry showing permission grants (geolocation, notifications, camera, microphone) to recently visited low-reputation domains.
User reports of unexpected permission prompts or prompts that appear to originate from a different site than the one in the address bar.

Detection Strategies

Inventory Chrome versions across managed endpoints using enterprise device management or software asset management data.
Correlate web proxy logs with newly granted permissions to identify users who visited untrusted sites immediately before a permission change.
Review browser policy reporting (Chrome Enterprise reporting) for anomalous PermissionAction events.

Monitoring Recommendations

Track Chrome stable channel release notes and apply version baselines as a compliance control.
Monitor outbound web traffic for suspicious domains delivering crafted HTML pages, especially those invoking permission APIs shortly after page load.
Audit per-site permission grants on critical user populations on a recurring basis.

How to Mitigate CVE-2026-11300

Immediate Actions Required

Update Google Chrome on Windows, macOS, and Linux to version 149.0.7827.53 or later.
Force-restart Chrome on managed endpoints after deployment to ensure the patched binary is active.
Reset or review previously granted site permissions for users who browsed untrusted sites prior to patching.

Patch Information

Google addressed CVE-2026-11300 in the Chrome stable channel update referenced in the Google Chrome Desktop Update advisory. Apply the update via Chrome's built-in updater, enterprise update servers, or operating system package management. Validate that all browser instances, including background processes, have been restarted to complete the upgrade.

Workarounds

Configure Chrome enterprise policies to set DefaultGeolocationSetting, DefaultNotificationsSetting, and related permission defaults to BlockGeolocation / BlockNotifications for untrusted sites until patching completes.
Restrict high-risk permissions to an allowlist of trusted origins via PermittedSites-style policies.
Train users to verify the origin shown in the permission prompt and to deny prompts on unfamiliar sites.

bash

# Example Chrome enterprise policy (Linux JSON managed policy)
{
  "DefaultGeolocationSetting": 2,
  "DefaultNotificationsSetting": 2,
  "DefaultMediaStreamSetting": 2,
  "URLBlocklist": ["*"],
  "URLAllowlist": ["https://corp.example.com", "https://*.example.com"]
}