CVE-2026-11691: Google Chrome Info Disclosure Flaw

CVE-2026-11691 Overview

CVE-2026-11691 affects Google Chrome versions prior to 149.0.7827.103. The vulnerability stems from insufficient validation of untrusted input in the New Tab Page component. A remote attacker who has already compromised the renderer process can leak cross-origin data through a crafted HTML page. The flaw is categorized under [CWE-20] Improper Input Validation. Google's Chromium project rated the underlying issue as High severity, while the National Vulnerability Database scores the CVE as Low due to the high attack complexity and prerequisite renderer compromise.

Critical Impact
An attacker with an already-compromised renderer process can bypass the same-origin policy and exfiltrate cross-origin data, breaking a core browser security boundary.

Affected Products

Google Chrome prior to 149.0.7827.103 on Microsoft Windows
Google Chrome prior to 149.0.7827.103 on Apple macOS
Google Chrome prior to 149.0.7827.103 on Linux

Discovery Timeline

2026-06-09 - CVE CVE-2026-11691 published to NVD
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-11691

Vulnerability Analysis

The vulnerability resides in Chrome's New Tab Page (NTP), a privileged browser surface that renders user-customizable content and integrates with Google services. The NTP processes input from multiple origins, including search suggestions, shortcuts, and feed content. Insufficient validation of untrusted input allows an attacker who controls a compromised renderer to influence how the NTP handles cross-origin resources.

Exploitation requires a prerequisite compromise of the renderer process, typically achieved through chaining with a separate memory corruption or logic flaw. Once the renderer is under attacker control, a crafted HTML page can manipulate NTP input handling to read data belonging to other origins. This violates the browser's same-origin policy, which normally isolates web content by origin.

The practical outcome is information disclosure of cross-origin data such as authenticated session content, cookies accessible to script, or DOM contents of unrelated sites. The flaw does not directly enable code execution or persistence, and user interaction is required to trigger the malicious flow.

Root Cause

The root cause is improper validation of data received from untrusted sources within the New Tab Page rendering logic. Trust boundaries between the renderer process and NTP-specific privileged interfaces are not enforced strictly enough, allowing malformed or attacker-controlled input to bypass origin checks during resource handling.

Attack Vector

The attack vector is network-based but requires a multi-stage exploit chain. The attacker must first compromise the renderer process through an independent vulnerability. The attacker then loads a crafted HTML page that abuses the input validation gap in the NTP. User interaction is required, and the attack complexity is high because it depends on chaining with a prior renderer compromise. See the Chromium Issue Tracker Entry for additional technical context.

Detection Methods for CVE-2026-11691

Indicators of Compromise

Chrome installations running versions older than 149.0.7827.103 exposed to untrusted web content
Unexpected network requests originating from chrome://newtab or NTP iframes referencing third-party origins
Renderer process crashes or sandbox escapes logged in Chrome crash telemetry prior to anomalous data access patterns

Detection Strategies

Inventory installed Chrome browser versions across managed endpoints and flag any below 149.0.7827.103
Monitor browser process telemetry for anomalous child process behavior, sandbox violations, or unexpected cross-origin fetch activity
Correlate web proxy logs with internal user browsing to identify visits to suspicious pages that immediately precede unusual outbound data flows

Monitoring Recommendations

Enable Chrome Enterprise reporting to centralize version, extension, and crash data for fleet-wide visibility
Alert on endpoints that fail to receive Chrome auto-updates within the standard update window
Track DLP and egress events tied to browser processes for signs of cross-origin data exfiltration

How to Mitigate CVE-2026-11691

Immediate Actions Required

Update Google Chrome to version 149.0.7827.103 or later on Windows, macOS, and Linux endpoints
Verify that Chrome auto-update is enabled and not blocked by group policy or network filtering
Restart browser sessions after the update to ensure the patched binary is active in memory

Patch Information

Google released the fix in the Chrome Stable channel at version 149.0.7827.103. Refer to the Google Chrome Release Update for the full advisory and channel details. Organizations using Chrome Enterprise should validate deployment via the admin console and prioritize systems that handle sensitive cross-origin sessions, such as workstations accessing SaaS administrative interfaces.

Workarounds

Restrict access to untrusted websites through enterprise web filtering until patches are deployed
Enforce Chrome site isolation policies (SitePerProcess) to strengthen renderer process boundaries
Disable or restrict third-party NTP customization extensions that increase the NTP attack surface

bash

# Verify installed Chrome version on Linux
google-chrome --version

# Enforce Site Isolation via Chrome policy (Linux example)
sudo mkdir -p /etc/opt/chrome/policies/managed
cat <<EOF | sudo tee /etc/opt/chrome/policies/managed/site_isolation.json
{
  "SitePerProcess": true,
  "IsolateOrigins": "https://*.example.com"
}
EOF