CVE-2026-11238 is a medium severity vulnerability in Google Chrome's DevTools affecting versions before 149.0.7827.53. It allows an attacker to obtain potentially sensitive information from process memory by tricking a user into installing a crafted malicious Chrome extension. The vulnerability is due to an inappropriate implementation in DevTools, categorized under CWE-306 (Missing Authentication for Critical Function). There is no indication of known exploits in the wild. The vulnerability requires user interaction (installing the malicious extension) and has a high attack complexity.

An attacker who successfully convinces a user to install a malicious Chrome extension can potentially access sensitive information from the browser's process memory. This could lead to confidentiality breaches but does not affect integrity or availability. The attack does not require privileges or user interaction beyond installing the extension.

Google has released Chrome version 149.0.7827.53 which addresses this vulnerability. Users and administrators should update to this version or later to remediate the issue. No additional mitigation steps are indicated in the vendor advisory.