CVE-2026-11166 is a medium severity vulnerability in Google Chrome's SVG implementation that permits remote attackers to perform UXSS by injecting arbitrary scripts or HTML through crafted HTML pages. The vulnerability affects Chrome versions prior to 149.0.7827.53. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality and integrity. The vendor advisory URL references a stable channel update but does not explicitly confirm patch status or remediation details.

Successful exploitation allows remote attackers to inject arbitrary scripts or HTML into the browser context, potentially leading to unauthorized actions or data exposure within the affected browser session. The vulnerability impacts confidentiality and integrity but does not affect availability. There are no known exploits in the wild at the time of publication.

The vulnerability is fixed in Google Chrome version 149.0.7827.53. Users and administrators should update to this version or later to remediate the issue. Since the vendor advisory does not explicitly state the remediation level, it is recommended to verify the update status via the official Chrome release notes. No additional mitigation steps are specified by the vendor.