CVE-2026-11689

HighCVSS 8.1/10Last modified Jul 23, 2026

Description

Insufficient policy enforcement in Passwords in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High)

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
Google	Chrome	>= 149.0.7827.103, < 149.0.7827.103

References

https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.htmlRelease Notes
https://issues.chromium.org/issues/517486004Permissions Required

Timeline

Published: Jun 9, 2026
Last modified: Jul 23, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-1168907.3Semantic MediaWiki from 3.0.0 before 7.3.0 contains a missing authorization vulnerability in the api.php smwtask module that allows unauthen CVE-2026-1168916.1SemanticMediaWiki from 4.2.0 before 7.2.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to i CVE-2026-1168926.1SemanticMediaWiki from 3.1.0 before 7.3.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to i CVE-2026-1168936.8REDAXO core before 5.21.5 contains a missing authorization vulnerability in the rex_api_package API function that lets non-admin backend use CVE-2026-1168944.2REDAXO before 5.21.5 contains an insufficient session expiration vulnerability that allows attackers to retain account access by keeping the CVE-2026-1168955.4REDAXO before 5.21.5 contains a cross-site request forgery vulnerability because the backend processes the safemode GET parameter in index.p CVE-2026-1168967.5REDAXO before 5.21.5 contains a missing authorization vulnerability in the backup addon export that accepts any database table, allowing non CVE-2026-1168976.5REDAXO core before 5.21.4 contains a missing authorization vulnerability in the structure/version and structure/history frontend preview mod CVE-2026-1168987.1REDAXO before 5.21.4 contains a missing authorization vulnerability in the media pool bulk move that checks only target category permission,CVE-2026-1168996.5REDAXO before 5.21.4 contains a broken access control vulnerability that allows authenticated editors to modify slices in unauthorized categ CVE-2026-11698.8A security vulnerability has been detected in birkir prime up to 0.4.0.beta.0. This vulnerability affects unknown code. Such manipulation le CVE-2026-116907.5Out of bounds read and write in Media in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker who had compromised the rend