CVE-2026-11126 is a vulnerability in the DevTools component of Google Chrome before version 149.0.7827.53. It arises from improper validation of untrusted input, enabling an attacker to leak cross-origin data by tricking a user into installing a crafted malicious Chrome extension. The vulnerability is classified under CWE-20 (Improper Input Validation) and has a medium severity level with a CVSS 3.1 base score of 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N). No known exploits in the wild have been reported. The vendor advisory linked does not explicitly confirm patch availability or remediation status.

An attacker who successfully convinces a user to install a malicious Chrome extension can exploit this vulnerability to leak cross-origin data, potentially exposing sensitive information from other origins. The impact is limited to confidentiality loss without integrity or availability impact. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users and administrators should monitor the official Google Chrome release notes and update to version 149.0.7827.53 or later once confirmed. Until then, avoid installing untrusted or suspicious Chrome extensions to mitigate risk.