This vulnerability (CVE-2026-11122) in Google Chrome's Keyboard implementation prior to version 149.0.7827.53 allows remote attackers to perform cross-site scripting (UXSS) by injecting arbitrary scripts or HTML through a crafted HTML page. The issue is classified under CWE-358 (Improperly Implemented Security Check for Standard). The CVSS 3.1 base score is 6.1 (Medium), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity. The vulnerability was publicly disclosed on June 4, 2026. The vendor advisory linked indicates a stable channel update for desktop Chrome but does not explicitly state patch availability or remediation level.

Successful exploitation of this vulnerability could allow an attacker to inject arbitrary scripts or HTML into the context of the affected browser, potentially leading to unauthorized access to sensitive information or manipulation of web content. The impact affects confidentiality and integrity but not availability. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Since the affected version is prior to 149.0.7827.53, updating to version 149.0.7827.53 or later is recommended once confirmed by the vendor. No additional mitigation details are provided by the vendor advisory at this time.