Executive brief
Google Chrome is a widely used web browser. A vulnerability in the browser's extension system allowed an attacker with control over a user's network connection to execute unauthorized code within a restricted environment. This could potentially allow an attacker to interfere with browser functions or access data managed by extensions, though the impact is limited by the browser's security sandbox.
Technical details
An inappropriate implementation vulnerability exists in the Extensions component of Google Chrome prior to version 149.0.7827.53. An attacker in a privileged network position (such as on the same local network or controlling a proxy) could exploit this flaw to execute arbitrary code within the browser's sandbox environment. The attack requires the use of a specifically crafted Chrome Extension. While the code execution is restricted by the sandbox, it represents a breach of the intended security boundaries for extension implementation. The issue was addressed in the stable channel update for Windows, Mac, and Linux.
Affected products
- Google Chrome prior to 149.0.7827.53
Timeline
- 2026-06-02: patched: Chrome 149.0.7827.53 released to stable channel.
- 2026-06-05: disclosed: CVE-2026-11269 published.