PT-2026-46696

CVE-2026-11169

Published

2026-04-13

Updated

2026-09-15

Description by

CVSS 2.0

9.4

High

MetricsAV:N/AC:L/Au:N/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 149.0.7827.53

Description An inappropriate implementation in XML allows a remote attacker to perform Universal Cross-Site Scripting (UXSS), which is a vulnerability that enables the execution of arbitrary scripts or HTML across different origins, by using a crafted XML file.

Recommendations Update to version 149.0.7827.53 or later.

Exploitability

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-91: XML Injection (aka Blind XPath Injection)

Related identifiers

CVE-2026-11169

BDU:2026-13058