CVE-2026-11193 describes an insufficient policy enforcement vulnerability in the Password Manager component of Google Chrome versions before 149.0.7827.53. This flaw allows a remote attacker to bypass discretionary access control restrictions by leveraging a specially crafted HTML page. The vulnerability is classified under CWE-284 (Improper Access Control) and has a CVSS v3.1 base score of 6.5, indicating a medium severity level. The impact is limited to availability, with no direct confidentiality or integrity compromise. No known exploits are reported in the wild. The vendor has published an advisory linked to a stable channel update but does not explicitly state the remediation level or patch availability in the provided data.

The vulnerability enables a remote attacker to bypass discretionary access controls in the Password Manager, potentially causing denial of service or disruption of availability. There is no reported impact on confidentiality or integrity. No known exploits in the wild have been identified.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Since the affected version is prior to 149.0.7827.53, updating to version 149.0.7827.53 or later is recommended if confirmed by the vendor advisory. Monitor official Google Chrome release notes for updates on fixes.