CVE-2026-11302 describes an insufficient policy enforcement vulnerability in Google Chrome on iOS versions before 149.0.7827.53. This flaw allows a remote attacker to bypass discretionary access control mechanisms by delivering a specially crafted HTML page. The vulnerability is identified as CWE-284 (Improper Access Control). The CVSS 3.1 base score is 4.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, low integrity impact, and no availability impact. There is no vendor advisory explicitly stating a patch or remediation level, but the affected version is listed as 149.0.7827.53, implying this version includes the fix.

The vulnerability allows a remote attacker to bypass discretionary access control in Chrome for iOS, potentially leading to unauthorized actions or access within the browser context. There is no impact on confidentiality or availability, and the integrity impact is low. No known exploits exist in the wild, reducing immediate risk.

The vulnerability is addressed in Google Chrome for iOS version 149.0.7827.53. Users should update to this version or later to remediate the issue. Since this is not a cloud service, remediation requires updating the client application. No additional mitigation steps are indicated by the vendor advisory.