CVE-2026-11222 is a vulnerability in Google Chrome's Tab Strip security UI prior to version 149.0.7827.53. The issue allows a remote attacker to craft HTML pages that spoof domains by exploiting incorrect UI representations, potentially misleading users about the legitimacy of the visited site. The vulnerability is classified under CWE-451 (Incorrect Security UI). The CVSS 3.1 base score is 6.5, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. There is no explicit vendor advisory statement confirming a patch, and no known exploits have been reported.

The vulnerability enables remote attackers to perform domain spoofing through crafted HTML pages, potentially misleading users into trusting malicious sites. This impacts the integrity of the user interface by displaying incorrect security information but does not affect confidentiality or availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Until official confirmation, users should update to the latest Chrome version when available to mitigate this issue.