CVE-2026-11264 is a vulnerability in Google Chrome's Content Security Policy implementation that allows remote attackers to bypass CSP protections by using a specially crafted HTML page. This affects Chrome versions before 149.0.7827.53. The vulnerability is categorized under CWE-693 (Protection Mechanism Failure). The CVSS 3.1 base score is 4.3, indicating a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, low integrity impact, and no availability impact. The vendor advisory linked does not explicitly state patch availability or remediation level, and no known exploits are reported.

An attacker can bypass Content Security Policy restrictions, potentially allowing limited integrity impact such as executing unauthorized scripts or content that CSP is designed to block. There is no impact on confidentiality or availability. The vulnerability requires user interaction and can be exploited remotely over the network.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Until a patch is confirmed, users should exercise caution when visiting untrusted websites and consider applying any available Chrome updates promptly once released.