CVE-2026-11169 is a high-severity vulnerability in Google Chrome's XML processing implementation prior to version 149.0.7827.53. It enables remote attackers to perform UXSS attacks by injecting arbitrary scripts or HTML through crafted XML files. The vulnerability is categorized under CWE-91 (Improper Neutralization of Output During Web Page Generation). Although a vendor advisory link is provided, it does not explicitly state whether a patch or fix has been released. The CVSS 3.1 vector indicates the attack requires no privileges and user interaction, with high impact on confidentiality and integrity but no impact on availability.

Successful exploitation allows remote attackers to inject arbitrary scripts or HTML content in the context of the affected browser, potentially leading to unauthorized actions or data disclosure through UXSS. This compromises the confidentiality and integrity of user data within the browser session. There are no reported exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Users and administrators should monitor for official updates from Google Chrome and apply them promptly once available. Until a fix is confirmed, exercising caution when handling untrusted XML content in the browser is advised.