CVE-2026-11254 is a medium severity vulnerability in Google Chrome's Permissions implementation before version 149.0.7827.53. It enables remote attackers to conduct UI spoofing attacks by crafting malicious HTML pages. The vulnerability is classified under CWE-451 (Incorrect Expression of User Interface in Security Decision). The CVSS vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality or availability impact, and low integrity impact. There is no explicit vendor advisory confirmation of a patch, but the affected version is listed as 149.0.7827.53, implying that versions prior to this are vulnerable.

The vulnerability allows remote attackers to perform UI spoofing, potentially misleading users by displaying deceptive user interface elements. This can lead to users being tricked into performing unintended actions or disclosing sensitive information. The CVSS score of 4.3 reflects a medium impact primarily on integrity with no direct confidentiality or availability impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Users and administrators should update Google Chrome to version 149.0.7827.53 or later once confirmed to contain the fix. Until then, caution is advised when interacting with untrusted web content that could exploit UI spoofing.