CVE-2026-11017 describes a security vulnerability in Google Chrome's Link Preview functionality before version 149.0.7827.53. The vulnerability enables a remote attacker, with control over the renderer process, to bypass navigation restrictions through a specially crafted HTML page. This issue is categorized under CWE-284 (Improper Access Control) and has a medium severity level with a CVSS 3.1 score of 6.5. The vulnerability does not impact confidentiality but can cause a high integrity impact, with no effect on availability. There is no explicit vendor advisory confirmation of a fix in the provided data, and no known exploits have been reported.

An attacker who has compromised the renderer process in affected versions of Google Chrome can bypass navigation restrictions, potentially leading to unauthorized actions or integrity violations within the browser context. The vulnerability does not affect confidentiality or availability but poses a high risk to integrity. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Until official confirmation is available, users should update to the latest Chrome version once a fix is announced. No other specific mitigations are provided in the advisory.