Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.5
CVE-2026-11018: Google Chrome prior to 149.0.7827.53: Bypassing navigation restrictions
CVE-2026-11018 · published 5 months ago
Summary
A remote attacker could trick a Google Chrome user into visiting a malicious website, potentially allowing the attacker to access sensitive information or take control of the user's browser. This issue affects users who rely on Google Chrome for online security. To fix this, update to the latest version of Google Chrome.
What to do
- Update debian chromium to version 149.0.7827.53-1~deb12u1.
- Update debian chromium to version 149.0.7827.53-1~deb13u1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:11 | debian | chromium | All versions |
| Debian:12 | debian | chromium |
< 149.0.7827.53-1~deb12u1 Fix: upgrade to 149.0.7827.53-1~deb12u1
|
| Debian:13 | debian | chromium |
< 149.0.7827.53-1~deb13u1 Fix: upgrade to 149.0.7827.53-1~deb13u1
|
| Debian:14 | debian | chromium | All versions |
Original advisory text
Insufficient policy enforcement in Actor in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Me...
Insufficient policy enforcement in Actor in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-602Client-Side Enforcement of Server-Side Security
Timeline
Published4 Jun 2026
Updated3 Nov 2026
First seen8 Jun 2026
Track software like this
Free during beta