CVE-2026-11695 Overview
CVE-2026-11695 is a cross-origin information disclosure vulnerability in the Passwords component of Google Chrome prior to version 149.0.7827.103. The flaw stems from an inappropriate implementation that allows a remote attacker to leak cross-origin data through a crafted HTML page. Google's Chromium project classifies the security severity as High, while NVD assigns a medium CVSS score reflecting the limited confidentiality impact and user interaction requirement.
The vulnerability falls under [CWE-693] (Protection Mechanism Failure) and affects Chrome installations on Windows, macOS, and Linux. Exploitation requires the victim to load attacker-controlled web content.
Critical Impact
A remote attacker can bypass cross-origin protections in the Passwords component and exfiltrate sensitive data from other origins via a crafted web page.
Affected Products
- Google Chrome versions prior to 149.0.7827.103
- Chrome on Microsoft Windows, Apple macOS, and Linux distributions
- Chromium-based browsers that share the affected Passwords component code
Discovery Timeline
- 2026-06-09 - CVE-2026-11695 published to NVD
- 2026-06-09 - Last updated in NVD database
- 2026-06-11 - EPSS scoring data published
Technical Details for CVE-2026-11695
Vulnerability Analysis
The defect resides in the Passwords subsystem of Chrome, which manages stored credentials and autofill behavior across origins. An inappropriate implementation permits a crafted HTML page to interact with the Passwords component in ways that expose data belonging to a different origin. This violates the Same-Origin Policy boundary that browsers enforce to isolate web content.
Exploitation requires user interaction, typically loading an attacker-controlled page or following a malicious link. The vulnerability impacts confidentiality only — there is no integrity or availability impact. The EPSS probability for in-the-wild exploitation activity is 0.032% at the time of publication.
Root Cause
The root cause is a failure in the Passwords component to properly enforce origin isolation [CWE-693]. When the component processes input or generates output associated with credential handling, the logic does not adequately scope access to the originating frame or document. As a result, data that should remain isolated to one origin becomes accessible to script executing in another origin.
Attack Vector
The attack vector is network-based and requires user interaction. An attacker hosts a crafted HTML page and lures a victim into visiting it through phishing, malvertising, or watering-hole techniques. Once the page loads in a vulnerable Chrome build, the attacker can trigger the inappropriate Passwords behavior to read cross-origin data such as stored values or autofill state tied to other sites.
No authentication is required, and the attack does not need local access. Refer to the Chromium Issue Tracker Entry and the Google Chrome Stable Update for additional technical context.
Detection Methods for CVE-2026-11695
Indicators of Compromise
- Browser telemetry showing Chrome versions older than 149.0.7827.103 on managed endpoints
- Outbound connections from Chrome processes to newly registered or low-reputation domains shortly after user navigation
- Unexpected autofill or password-manager events observed in browser audit logs
Detection Strategies
- Inventory installed Chrome versions across endpoints and flag any build below 149.0.7827.103
- Monitor DNS and HTTP egress for suspicious domains delivering crafted HTML pages, correlating with browser process activity
- Inspect Chrome enterprise reporting and management APIs for users visiting untrusted URLs from email clients or messaging applications
Monitoring Recommendations
- Aggregate browser version data and web navigation telemetry into a central analytics platform for continuous version compliance checks
- Alert on user reports of unexpected password prompts, autofill behavior, or session anomalies that may indicate exploitation attempts
- Track threat intelligence feeds for proof-of-concept disclosures referencing the Chromium issue 517762104
How to Mitigate CVE-2026-11695
Immediate Actions Required
- Update Google Chrome to version 149.0.7827.103 or later on all Windows, macOS, and Linux endpoints
- Verify Chromium-based browsers in the environment have absorbed the upstream fix and update accordingly
- Restart Chrome after applying the update to ensure the patched binary is loaded
Patch Information
Google addressed CVE-2026-11695 in the Stable channel update referenced in the Google Chrome Stable Update advisory. Administrators should validate that endpoint management tooling has rolled out Chrome 149.0.7827.103 or newer. Browsers built on Chromium typically receive the fix once they rebase to the patched upstream release.
Workarounds
- Restrict browsing to trusted sites through enterprise web filtering until patching completes
- Disable Chrome password autofill via the PasswordManagerEnabled enterprise policy as a temporary control where feasible
- Enforce automatic Chrome updates using group policy or MDM to reduce exposure windows for future browser vulnerabilities
# Verify Chrome version on Linux/macOS endpoints
google-chrome --version
# Windows enterprise policy snippet to disable password autofill
# HKLM\SOFTWARE\Policies\Google\Chrome
# PasswordManagerEnabled = 0 (DWORD)
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
