CVE-2026-11139 is a medium severity vulnerability in Google Chrome's Paint implementation before version 149.0.7827.53. It enables a remote attacker to bypass same-origin policy restrictions and leak cross-origin data by crafting a malicious HTML page. The vulnerability is identified as CWE-352 (Cross-Site Request Forgery). The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, high confidentiality impact, and no impact on integrity or availability. No known exploits are reported in the wild. The vendor advisory linked does not explicitly state patch availability or remediation level, so patch status is not yet confirmed.

Successful exploitation allows an attacker to bypass same-origin policy restrictions and leak sensitive cross-origin data, compromising confidentiality. There is no impact on integrity or availability. The vulnerability requires user interaction and can be exploited remotely over the network.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Until a patch is confirmed, users should exercise caution when visiting untrusted websites and avoid interacting with suspicious content that could trigger the vulnerability.