Inappropriate Implementation in Chrome Extensions Allows Access Control Bypass

Publication date: 2026-06-04

Last updated on: 2026-06-09

Assigner: Chrome

Description

Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension to bypass discretionary access control via a crafted Chrome Extension. (Chromium security severity: Medium)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-04

Last Modified

2026-06-09

Generated

2026-07-15

AI Q&A

2026-06-05

EPSS Evaluated

2026-07-14

NVD

CVE-2026-11190

EUVD

EUVD-2026-34651

Affected Vendors & Products

Vendor	Product	Version / Range
google	chrome	to 149.0.7827.53 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Extensions component of Google Chrome versions prior to 149.0.7827.53. It allows an attacker who convinces a user to install a malicious Chrome extension to bypass discretionary access control by using a specially crafted extension.

Impact Analysis

If exploited, this vulnerability could allow an attacker to bypass security controls that restrict access to certain resources or actions within Chrome. This could lead to unauthorized access or actions performed through the malicious extension, potentially compromising user data or browser security.

Hi! I’m here to help you understand CVE-2026-11190. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70