CVE-2026-11299 is an integer overflow vulnerability in the Fonts subsystem of Google Chrome versions before 149.0.7827.53. Exploitation requires a user to visit a maliciously crafted HTML page, which triggers an out-of-bounds read, potentially leaking sensitive information from the browser's process memory. The vulnerability is classified under CWE-190 (Integer Overflow or Wraparound). The CVSS vector indicates the attack is network-based, requires no privileges but user interaction, and impacts confidentiality with high severity but does not affect integrity or availability.

Successful exploitation can result in disclosure of sensitive information from the browser's memory space. There is no indication of integrity or availability impact. No known exploits are reported in the wild at this time.

A fix is available in Google Chrome version 149.0.7827.53. Users and administrators should update to this version or later to mitigate this vulnerability. The vendor advisory linked confirms the update but does not indicate any temporary mitigations or that no action is required.