Executive brief
A vulnerability in Google Chrome's Subresource Integrity (SRI) feature could allow a remote attacker to bypass security policies. SRI is a security feature that ensures files fetched by a browser (like scripts or stylesheets) haven't been tampered with. An exploit could allow malicious network traffic to bypass Content Security Policy (CSP) protections, potentially leading to the execution of unauthorized code or scripts on a user's machine.
Technical details
A vulnerability exists in Google Chrome prior to version 149.0.7827.53 due to insufficient policy enforcement within the Subresource Integrity (SRI) component. SRI is designed to validate that fetched resources match a cryptographic hash provided by the website owner. By manipulating network traffic, a remote attacker could exploit this flaw to bypass Content Security Policy (CSP) restrictions. This is classified as an Improper Input Validation issue (CWE-20). The vulnerability is reachable over the network and requires the victim to encounter malicious traffic, potentially allowing for the loading of unauthorized subresources. The issue is resolved in Chrome version 149.0.7827.53 and later.
Affected products
- Google Chrome prior to 149.0.7827.53
Timeline
- 2026-06-02: patched: Chrome 149.0.7827.53 promoted to stable channel.
- 2026-06-04: disclosed: CVE-2026-11038 published.