CVE-2026-11084 describes a medium severity vulnerability in Google Chrome's Password Manager before version 149.0.7827.53. The flaw allows a remote attacker to leak cross-origin data by exploiting an inappropriate implementation in the Password Manager via a specially crafted HTML page. The vulnerability is related to CWE-346 (Origin Validation Error) and CWE-352 (Cross-Site Request Forgery), indicating issues with origin validation and request forgery protections. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high confidentiality impact. There is no known exploit in the wild. The vendor advisory linked is a Chrome stable channel update announcement, but it does not explicitly confirm patch availability or remediation level.

Successful exploitation can lead to unauthorized disclosure of cross-origin data, compromising user confidentiality. There is no impact on data integrity or availability. The vulnerability requires user interaction and can be triggered remotely via a crafted HTML page.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Users and administrators should update Google Chrome to version 149.0.7827.53 or later once the update is confirmed to address this vulnerability. Until then, exercise caution with untrusted web content that could exploit the Password Manager.