CVE-2026-11684: Google Chrome Information Disclosure Flaw

CVE-2026-11684 Overview

CVE-2026-11684 is an insufficient policy enforcement vulnerability in the Network component of Google Chrome prior to version 149.0.7827.103. The flaw allows a remote attacker who has already compromised the utility process to leak cross-origin data through a crafted HTML page. Chromium classifies the security severity as High, while NVD scores it as Low due to the prerequisite of an already-compromised utility process. The issue is tracked as [CWE-693: Protection Mechanism Failure] and affects Chrome on Windows, macOS, and Linux.

Critical Impact
An attacker controlling the Chrome utility process can bypass network policy enforcement and exfiltrate cross-origin data from other web origins loaded in the browser.

Affected Products

Google Chrome prior to 149.0.7827.103
Chrome on Microsoft Windows
Chrome on Apple macOS and Linux

Discovery Timeline

2026-06-09 - CVE-2026-11684 published to NVD
2026-06-09 - Google releases Stable Channel update for Desktop
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-11684

Vulnerability Analysis

The vulnerability resides in Chrome's Network service, which enforces same-origin and cross-origin policies for HTTP requests and responses. Chrome's multi-process architecture isolates renderers, the browser process, and utility processes, each with restricted capabilities. The Network service runs inside a utility process and applies policy checks intended to prevent data from one origin reaching another.

The flaw stems from insufficient enforcement of these policies once the utility process is compromised. An attacker who has already achieved code execution within the utility process can bypass the cross-origin checks. This allows the attacker to read response data belonging to origins the victim has loaded.

Exploitation requires chaining with a separate vulnerability that compromises the utility process, plus user interaction with attacker-controlled HTML content. The complexity is high and the resulting confidentiality impact is limited to cross-origin data exposure. No integrity or availability impact is reported, and EPSS reflects a low near-term exploitation probability.

Root Cause

The root cause is a protection mechanism failure [CWE-693] inside the Network component. Policy enforcement assumed the utility process boundary as a trust anchor, so checks were not robust enough to block cross-origin reads originating from a compromised utility process.

Attack Vector

The attack is network-based and requires user interaction. A victim must load a crafted HTML page while the attacker holds code execution in the utility process. The attacker then issues network requests that the weakened policy layer fails to block, returning cross-origin response bodies to attacker-controlled code. See the Chromium Issue Tracker #517130229 and the Google Chrome Stable Update for additional technical references.

Detection Methods for CVE-2026-11684

Indicators of Compromise

Chrome browser processes running versions earlier than 149.0.7827.103 on managed endpoints.
Anomalous network requests originating from Chrome's utility process to unexpected external domains.
Crash or instability events in the Chrome network utility process preceding outbound data transfers.

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any host below 149.0.7827.103.
Monitor Chrome child processes for unusual outbound HTTPS connections that do not correspond to active user tabs.
Correlate browser crash telemetry with subsequent network egress to identify potential utility-process compromise chains.

Monitoring Recommendations

Ingest browser telemetry and proxy logs into a centralized analytics platform for cross-origin request analysis.
Alert on Chrome processes spawning network connections to newly observed or low-reputation domains.
Track Chrome auto-update status to confirm patched versions roll out within enterprise SLAs.

How to Mitigate CVE-2026-11684

Immediate Actions Required

Update Google Chrome to version 149.0.7827.103 or later on Windows, macOS, and Linux endpoints.
Force-restart Chrome on managed devices to apply the staged update and verify the running version.
Block or restrict known malicious domains hosting crafted HTML payloads at the web proxy or DNS layer.

Patch Information

Google addressed CVE-2026-11684 in the Stable Channel update on 2026-06-09. Administrators should deploy Chrome 149.0.7827.103 or later. Details are published in the Google Chrome Stable Update advisory.

Workarounds

No vendor-supplied workaround exists; updating Chrome is the required remediation.
Restrict browsing to trusted sites via enterprise policy until the patch is verified on all endpoints.
Enable Chrome's enterprise auto-update policies to reduce exposure windows for future Network component flaws.

bash

# Verify Chrome version on Linux endpoints
google-chrome --version

# Windows: query installed version via registry
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv