CVE-2026-11260 is a content security policy bypass vulnerability in Google Chrome versions before 149.0.7827.53. The root cause is an inappropriate implementation in the Permissions subsystem, which allows a remote attacker to circumvent content security policies by delivering a crafted HTML page. The vulnerability is classified under CWE-693 (Protection Mechanism Failure). The CVSS v3.1 base score is 4.3, indicating medium severity, with attack vector network, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, limited integrity impact, and no availability impact.

The vulnerability allows an attacker to bypass content security policies, potentially enabling the execution of unauthorized scripts or actions within the browser context. However, it does not directly compromise confidentiality or availability. The integrity impact is limited, and no known exploits are reported in the wild at this time.

No explicit patch or remediation level is provided in the available data. The vendor advisory linked (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html) should be consulted for the latest update status and patch availability. Until a patch is confirmed, users should consider updating to version 149.0.7827.53 or later once available. No additional mitigation steps are specified by the vendor.