CVE-2026-11153: critical vulnerability in Google Chrome
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
A weakness in Google Chrome's form handling allows attackers to steal private data from other websites through a specially crafted webpage. This happens because Chrome didn't properly isolate form information between different websites.
Side-channel vulnerability in Chrome's form processing (CWE-1300) enables cross-origin data exfiltration via crafted HTML. An unauthenticated remote attacker can exploit timing or behavioral side-channels in form rendering to infer sensitive information from cross-origin contexts. Affected versions prior to 149.0.7827.53; requires user interaction with malicious page.
In the same product, most dangerous first.