CVE-2026-11653: Google Chrome Auth Bypass Vulnerability

CVE-2026-11653 Overview

CVE-2026-11653 is an inappropriate implementation flaw in the Extensions component of Google Chrome prior to version 149.0.7827.103. A remote attacker who has already compromised the renderer process can bypass site isolation by serving a crafted HTML page. Chromium rates the security severity as High, while the NVD CVSS v3.1 base score is 6.5 (Medium). The vulnerability affects Chrome on Windows, macOS, and Linux. Successful exploitation breaks a core browser security boundary, enabling cross-origin data access that site isolation is designed to prevent. The flaw is tracked under CWE-20: Improper Input Validation.

Critical Impact
An attacker with a compromised renderer process can defeat Chrome's site isolation boundary, exposing data from other origins through a crafted HTML page.

Affected Products

Google Chrome versions prior to 149.0.7827.103
Chrome desktop on Microsoft Windows, Apple macOS, and Linux
Chromium-based browsers that incorporate the vulnerable Extensions implementation

Discovery Timeline

2026-06-09 - CVE-2026-11653 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-11653

Vulnerability Analysis

The vulnerability resides in Chrome's Extensions implementation, where input handling fails to enforce the boundaries that site isolation depends on. Site isolation places documents from different sites into separate renderer processes so that a compromised renderer cannot read cross-site data. The flaw in the Extensions subsystem provides a path for an attacker who already controls a renderer to reach data or capabilities outside its assigned site boundary. Exploitation requires a user to load attacker-controlled content, which triggers the crafted HTML logic in conjunction with extension-related interfaces. The integrity impact is High because attacker code can manipulate state across the isolation boundary, while confidentiality and availability impacts are not directly assessed by the published vector.

Root Cause

The root cause is improper input validation [CWE-20] inside the Extensions component. The implementation does not adequately constrain or verify inputs crossing between renderer-hosted content and extension-mediated browser surfaces. This allows a crafted HTML page, processed by an already compromised renderer, to drive the Extensions code into a state that violates site isolation guarantees.

Attack Vector

Exploitation is a chained scenario. The attacker first compromises a renderer process, typically through a separate memory corruption or logic bug. The attacker then serves a crafted HTML page that abuses the Extensions implementation to escape the per-site renderer sandbox boundary. The attack is network-reachable, requires user interaction to load the page, and does not require privileges on the target system. Technical specifics are restricted in the Chromium issue tracker pending broader patch deployment.

Detection Methods for CVE-2026-11653

Indicators of Compromise

Chrome browser processes running versions earlier than 149.0.7827.103 after the patch release date
Renderer process crashes or anomalous child-process spawns correlated with browsing sessions on untrusted sites
Outbound connections from Chrome to newly observed or low-reputation domains following navigation to attacker-controlled HTML

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag any host below 149.0.7827.103
Monitor browser telemetry for unexpected extension activity, including extension installs, permission changes, or message-passing anomalies
Correlate web proxy logs with endpoint process telemetry to identify users visiting suspicious pages while running unpatched Chrome

Monitoring Recommendations

Enable Chrome enterprise reporting to centralize version, extension inventory, and crash data
Alert on renderer crash bursts on a single host, which can indicate exploitation attempts against the renderer prior to the site isolation bypass
Track changes to extension manifests and host permissions in managed Chrome deployments

How to Mitigate CVE-2026-11653

Immediate Actions Required

Update Google Chrome to version 149.0.7827.103 or later on Windows, macOS, and Linux endpoints
Force-relaunch Chrome after deployment so the patched binary replaces running processes
Audit installed extensions and remove any that are unused, unsigned, or sourced outside the Chrome Web Store

Patch Information

Google released a fix in the Chrome Stable channel update documented in the Chrome Releases blog. Administrators should ensure clients are on 149.0.7827.103 or newer. Tracking details are available in the Chromium Issue Tracker entry 513321171.

Workarounds

Restrict extension installation through Chrome enterprise policies such as ExtensionInstallBlocklist and ExtensionInstallAllowlist
Enforce SitePerProcess policy to ensure full site isolation remains enabled on all managed endpoints
Limit user browsing to trusted sites via DNS or web proxy filtering until patch deployment is verified

bash

# Example Chrome enterprise policy (Linux JSON policy file)
# /etc/opt/chrome/policies/managed/cve-2026-11653.json
{
  "SitePerProcess": true,
  "ExtensionInstallBlocklist": ["*"],
  "ExtensionInstallAllowlist": [
    "<approved-extension-id-1>",
    "<approved-extension-id-2>"
  ],
  "DefaultBrowserSettingEnabled": true
}