CVE WatchJul 23, 2026

CVE-2026-11229

Inappropriate implementation in Enterprise in Google Chrome prior to 149.0.7827.53 allowed a local attacker to perform privilege escalation

CVSS

6.1

Medium

EPSS

0.1%

KEV

—

Exploit Today

0-100

Published: Jun 4, 2026 · Last modified: Jul 23, 2026 · CWE-269

EPSS · 30d

0.1%EPSS · 30 days0.1%

2026-09-232026-10-21

Technical description

Inappropriate implementation in Enterprise in Google Chrome prior to 149.0.7827.53 allowed a local attacker to perform privilege escalation via physical access to the device. (Chromium security severity: Low)

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-1140698.1 HIG

16.5%

——5Trigger.dev before 4.6.0 contains an improper authorization vulnerability in the GET /api/v1/projects/:projectRef/envvars endpoint, which returns the environment's root API key as TRIGGER_SECRET_KEY for staging, production, and preview environments. Attackers holding a restricted read:envvars key can obtain the root secret and plaintext secrets, then trigger tasks and mint admin public JWTs.1d CVE-2026-1053129.9 CRI

25.7%

——8A Kubernetes tenant with create permission on Console custom resources can set spec.containers.api.spec.image to an arbitrary container image. The operator deploys this image into a pod whose ServiceAccount is bound via ClusterRoleBinding to a ClusterRole granting cluster-wide get/list/watch on all Strimzi CRDs (including KafkaUsers), patch on Kafkas/KafkaRebalances, and cluster-monitoring-view. The attacker's code reads the projected SA token and gains cross-tenant Strimzi control-plane read+write access.2d CVE-2026-869333.3 LOW

0.4%

——0A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Golden Gate 27. An app may be able to access information about a user's contacts.2d CVE-2026-869216.2 MED

1.2%

——0A permissions issue was addressed with improved validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. A local attacker may be able to overwrite restricted files.2d CVE-2026-288537.8 HIG

3.3%

——1The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to elevate privileges.1d CVE-2026-1054538.4 HIG

0.6%

——0IBM Sterling Connect Direct for Unix 6.3.0.0 through 6.3.0.7 and 6.4.0.0 through 6.4.0.6 could allow a local attacker to gain elevated privileges due to improper privilege management.1d