CVE-2026-11221 is a vulnerability in Google Chrome's PointerLock implementation before version 149.0.7827.53. It stems from insufficient validation of untrusted input, enabling a remote attacker with control over the renderer process to conduct UI spoofing attacks by delivering a specially crafted HTML page. The vulnerability is categorized under CWE-20 (Improper Input Validation) and has been assigned a medium severity level by Chromium security with a CVSS 3.1 base score of 4.3. No known exploits are reported in the wild. The vendor advisory linked does not explicitly state the availability of a patch or remediation level.

The vulnerability allows an attacker who has already compromised the renderer process to perform UI spoofing, potentially misleading users by displaying deceptive user interface elements. There is no direct impact on confidentiality or availability, and the attack requires user interaction (UI) to be effective. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Since the vulnerability affects versions prior to 149.0.7827.53, updating to version 149.0.7827.53 or later is recommended if confirmed by the vendor. Monitor official Google Chrome release notes for an official fix or temporary mitigation instructions.