CVE-2026-11199 describes a medium severity vulnerability in Google Chrome's WebRTC component before version 149.0.7827.53. The flaw involves improper validation of untrusted input, enabling an attacker positioned within the network to leak cross-origin data by crafting malicious network traffic. This vulnerability is classified under CWE-20 (Improper Input Validation). The CVSS vector indicates network attack vector with high attack complexity, no privileges or user interaction required, and impacts confidentiality but not integrity or availability. No official remediation level or patch confirmation is provided in the vendor advisory linked.

An attacker with privileged network access can exploit this vulnerability to leak sensitive cross-origin data from the victim's browser, potentially compromising confidentiality. There is no impact on data integrity or availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Until an official fix is confirmed, users should exercise caution when connected to untrusted networks and consider limiting exposure to network-based attacks.