This vulnerability (CVE-2026-11267) affects Google Chrome versions before 149.0.7827.53. It arises from insufficient enforcement of policies in Chrome extensions, enabling a malicious extension to bypass the content security policy. The issue requires user interaction, specifically convincing the user to install the malicious extension. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, low integrity impact, and no availability impact. The vendor advisory link is available but does not explicitly state if the issue is fixed in version 149.0.7827.53 or later.

An attacker who successfully convinces a user to install a crafted malicious Chrome extension can bypass the content security policy, potentially leading to integrity impacts within the browser environment. There is no impact on confidentiality or availability. The vulnerability requires user interaction and has low attack complexity.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Until confirmation of a fix, users should avoid installing untrusted extensions and apply updates promptly once available.