CVE-2026-11135: Insufficient policy enforcement in Google Chrome
CVE-2026-11135 is a vulnerability in Google Chrome's Autofill feature prior to version 149. 0. 7827. 53. It involves insufficient policy enforcement that allows a remote attacker to bypass discretionary access control using a crafted HTML page. The vulnerability has been assigned a medium severity by Chromium security. There is no CVSS score available for this issue. The vendor advisory linked does not explicitly state the patch or remediation status. No known exploits in the wild have been reported.
AI Analysis
Technical Summary
This vulnerability in Google Chrome affects the Autofill component, where insufficient policy enforcement enables a remote attacker to bypass discretionary access control mechanisms by leveraging a specially crafted HTML page. The issue impacts versions prior to 149.0.7827.53. The Chromium security team has rated the severity as medium. The vendor advisory is available but does not explicitly confirm patch availability or remediation steps. The product is not a cloud service, so remediation depends on user updates.
Potential Impact
The impact is a potential bypass of discretionary access control in the Autofill feature of Google Chrome, which could allow unauthorized access to autofill data or related functionality. However, no known exploits have been reported in the wild, and the severity is considered medium by Chromium security.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Users should update to version 149.0.7827.53 or later once confirmed available. Until then, exercise caution with untrusted web content that might exploit Autofill behavior.
CVE-2026-11135: Insufficient policy enforcement in Google Chrome
Description
CVE-2026-11135 is a vulnerability in Google Chrome's Autofill feature prior to version 149. 0. 7827. 53. It involves insufficient policy enforcement that allows a remote attacker to bypass discretionary access control using a crafted HTML page. The vulnerability has been assigned a medium severity by Chromium security. There is no CVSS score available for this issue. The vendor advisory linked does not explicitly state the patch or remediation status. No known exploits in the wild have been reported.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in Google Chrome affects the Autofill component, where insufficient policy enforcement enables a remote attacker to bypass discretionary access control mechanisms by leveraging a specially crafted HTML page. The issue impacts versions prior to 149.0.7827.53. The Chromium security team has rated the severity as medium. The vendor advisory is available but does not explicitly confirm patch availability or remediation steps. The product is not a cloud service, so remediation depends on user updates.
Potential Impact
The impact is a potential bypass of discretionary access control in the Autofill feature of Google Chrome, which could allow unauthorized access to autofill data or related functionality. However, no known exploits have been reported in the wild, and the severity is considered medium by Chromium security.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Users should update to version 149.0.7827.53 or later once confirmed available. Until then, exercise caution with untrusted web content that might exploit Autofill behavior.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Chrome
- Date Reserved
- 2026-06-04T17:06:58.099Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
- Vendor Advisory Urls
- [{"url":"https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html","vendor":"Google"}]
Threat ID: 6a220845e29bf47b50dbc5d7
Added to database: 6/4/2026, 11:20:37 PM
Last enriched: 6/5/2026, 1:18:43 AM
Last updated: 6/5/2026, 4:21:40 AM
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.