CVE-2026-11048 Security feature bypass in Chrome

Medium 6.5 Published 4 Jun 2026 Updated 5 Jun 2026

An attacker can bypass same-origin policy by tricking a user into installing a malicious Chrome extension, compromising browser security boundaries.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2026-11048?

CVE-2026-11048 is a medium-severity vulnerability in Google Chrome, published on 4 Jun 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension to bypass same origin policy via a crafted Chrome Extension. (Chromium security severity: Medium)

Weakness: CWE-346

Which versions are affected by CVE-2026-11048?

It affects 1 product.

Products include Google Chrome.

How do I fix CVE-2026-11048?

Upgrade to a fixed version.

Is CVE-2026-11048 being exploited?

There is no known exploitation of CVE-2026-11048 in the wild and no public exploit code.

All Google Chrome vulnerabilities

Sources

Also known as DEBIAN-CVE-2026-11048, ECHO-ca1b-b22b-f5da, GHSA-mx9q-p75x-m88c, MINI-5jqr-242f-77hf.