CVE-2026-11017

MediumCVSS 6.5/10Last modified Jul 22, 2026

Description

Inappropriate implementation in Link Preview in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-284

Affected software

Vendor	Product	Versions
Google	Chrome	>= 149.0.7827.53, < 149.0.7827.53

References

https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.htmlRelease Notes, Vendor Advisory
https://issues.chromium.org/issues/497336872Permissions Required

Timeline

Published: Jun 4, 2026
Last modified: Jul 22, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-1101704.3Use after free in Bindings in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to read memory inside the sandbox via a crafted CVE-2026-1101718.8Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a CVE-2026-1101728.8Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a CVE-2026-1101768.7The File Force Download module for Drupal 7 implements hook_file_download() to add a Content-Disposition header when a file URL carries the CVE-2026-1101784.1IBM ContextForge MCP Gateway 1.0.0 through 1.0.11 is vulnerable to improper access control in the bulk import path. A remote authenticated a CVE-2026-1101796.8The affiliate-toolkit WordPress plugin before 3.8.9 does not validate a user-supplied sort value against an allowlist before using it in a CVE-2026-110186.5Insufficient policy enforcement in Actor in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass navigation restrictions CVE-2026-1101804.8fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions from 2.4.2 through 2.4.7, from 3.1.3 through 3.1.8 CVE-2026-1101816.5PostgreSQL Anonymizer contains a vulnerability related to anonymization functions defined using SQL-standard function bodies. PostgreSQL ana CVE-2026-1101824.3PostgreSQL Anonymizer contains a vulnerability related to the anon.partial() and anon.partial_email() functions. These function can reveal t CVE-2026-1101834.3PostgreSQL Anonymizer contains a vulnerability related to static masking and statistics persistence. Statistics pertaining to the original d CVE-2026-1101847.5The Newsmatic theme for WordPress is vulnerable to blind SQL Injection via the 'slug' parameter in all versions up to, and including, 1.5.0