CVE-2026-11212
Insufficient policy enforcement in DevTools in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a ma
CVSS
4.3
Medium
EPSS
0.1%
p3
KEV
—
Exploit Today
1
0-100
Published: Jun 4, 2026 · Last modified: Jul 23, 2026 · CWE-284
0.1%EPSS · 30 days0.1%
2026-09-282026-10-26
Insufficient policy enforcement in DevTools in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension to leak cross-origin data via a crafted Chrome Extension. (Chromium security severity: Medium)
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-829864.6 MED—
———The user in a group can bypass the group restriction set by an administrator on link sharing, creating share links for a table even though they shouldn't have that permission.3hCVE-2026-829844.3 MED—
———When a team was configured as "visible to everyone", the web UI correctly blocked non-members from viewing the team ("You are not a member of ..."), but the resources API endpoint could still be called directly, allowing any authenticated non-member to enumerate the team's internal resources and their identifiers.
This does not grant access to the contents of the discovered resources themselves, only their existence, names, and identifiers.3hCVE-2026-771734.3 MED—
———A user could create a docx or odt file with a # in the filename with confidential information such as a credit card number and have it not be marked as confidential.3hCVE-2026-771713.5 LOW—
———A public shared collective always allowed recipients of the link to create pages.3hCVE-2026-674003.5 LOW—
———A missing token type check allowed to retrieve more additional information about the WOPI configuration with a user or guest token.3hCVE-2026-1175127.3 HIG—
———A vulnerability was found in oretnom23 php-travel-agency-system. This affects an unknown part of the file admin/employee_insert.php. Performing a manipulation of the argument employee photo results in unrestricted upload. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.3h