CVE-2026-11169: Inappropriate implementation in XML in Google Chrome prior to 149

Synopsis

Universal Cross-Site Scripting (UXSS) via inappropriate XML handling in Google Chrome prior to version 149.0.7827.53. A remote attacker can reach this vulnerability over the network without authentication, but requires the victim to open a crafted XML file. Successful exploitation allows the attacker to inject and execute arbitrary scripts or HTML across any origin the browser has access to, disclosing sensitive data and tampering with page content. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted XML file over the network, so the target Chrome instance must be reachable or the user must be browsing to attacker-controlled content.

• AuthenticationNot required

  No account or credential is needed; the attacker only needs the victim to open a crafted file or visit a crafted page.

• Victim interactionRequired

  The victim must open or load a specially crafted XML file, making this a social-engineering or drive-by delivery scenario.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and imposes no special race conditions or environmental preconditions on the attacker.

Blast Radius

• Reads session cookies, authentication tokens, and any sensitive data accessible to the current browser origin.
• Injects and runs arbitrary JavaScript across any origin the browser session has open, bypassing the same-origin policy.
• Modifies displayed page content in the victim's browser, enabling credential-harvesting overlays or UI redress attacks.