CVE-2026-11011: Insufficient policy enforcement in Password Manager in Google Chrome prior to 149

Synopsis

This is an insufficient policy enforcement vulnerability in the Google Chrome Password Manager affecting versions prior to 149.0.7827.53. A remote attacker who has already compromised the Chrome renderer process can exploit it by serving a crafted HTML page, which the victim must visit, bypassing Chrome's site isolation protections. Successful exploitation allows the attacker to read and tamper with sensitive data that site isolation would normally protect, including credentials managed by the Password Manager. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the victim over the network by serving a crafted HTML page, making the service's network exposure a prerequisite.

• AuthenticationNot required

  No authentication is needed; the attacker requires no account or credentials on the target system to deliver the malicious page.

• Victim interactionRequired

  The victim must visit or load the attacker's crafted HTML page, requiring a social-engineering or drive-by delivery step.

• Attack complexityDetail

  Attack complexity is rated Low, meaning the exploit is reliable and does not depend on race conditions or specific environmental layout, though a prior renderer compromise is a precondition noted in the CVE description.

Blast Radius

• Reads credentials and sensitive data stored in the Chrome Password Manager that site isolation would otherwise wall off.
• Reads cross-origin page content from other sites open in the same browser session.
• Modifies cross-origin data or injects content into isolated site contexts, breaking the integrity guarantees of site isolation.