CVE-2026-11153
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 9.1epss 0.3%
exploitation probability
0.3%top 82% of all CVEs
observed exploitation
nono source reports it
In short
A weakness in Google Chrome's form handling allows attackers to steal private data from other websites through a specially crafted webpage. This happens because Chrome didn't properly isolate form information between different websites.
Technical detail
Side-channel vulnerability in Chrome's form processing (CWE-1300) enables cross-origin data exfiltration via crafted HTML. An unauthenticated remote attacker can exploit timing or behavioral side-channels in form rendering to infer sensitive information from cross-origin contexts. Affected versions prior to 149.0.7827.53; requires user interaction with malicious page.
Summary generated and translated by AI from the official description.
Side-channel information leakage in Forms in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected products
Google · Chrome