CVE-2026-11294 describes a UI spoofing vulnerability in Google Chrome's password management implementation before version 149.0.7827.53. This flaw allows a remote attacker to craft an HTML page that can deceive users by spoofing the user interface, potentially misleading users about the authenticity of password prompts or dialogs. The vulnerability is rated with a CVSS 3.1 base score of 4.3 (medium severity), reflecting low impact on confidentiality but an integrity impact due to UI spoofing. No official remediation level or patch confirmation is provided in the available data, though a vendor advisory link is given.

The vulnerability enables remote attackers to perform UI spoofing, which can mislead users into interacting with deceptive password prompts or dialogs. This may lead to reduced user trust or potential phishing scenarios but does not directly compromise confidentiality or availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Until official confirmation of a fix is available, users should exercise caution when interacting with password prompts in Chrome and avoid clicking on suspicious links or pages.