CVE WatchJul 23, 2026

CVE-2026-11236

Insufficient policy enforcement in Web Bluetooth in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the r

CVSS

8.3

High

EPSS

0.2%

KEV

—

Exploit Today

0-100

Published: Jun 4, 2026 · Last modified: Jul 23, 2026 · CWE-602

EPSS · 30d

0.2%EPSS · 30 days0.2%

2026-07-102026-08-07

Technical description

Insufficient policy enforcement in Web Bluetooth in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-148315.3 MED

23.4%

——7The Easy Booking WordPress plugin before 3.5.0 does not re-enforce a bookable product's configured minimum booking duration on the server side when adding to cart and calculating the booking price, allowing unauthenticated users to place below-minimum bookings and complete underpriced orders.1d CVE-2026-179856.5 MED

12.1%

——4Insufficient policy enforcement in Speech in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: Low)5d CVE-2026-179746.5 MED

6.7%

——2Insufficient policy enforcement in DevTools in Google Chrome prior to 151.0.7922.72 allowed a local attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)5d CVE-2026-179604.3 MED

9.5%

——3Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to bypass no-referrer policy via a crafted HTML page. (Chromium security severity: Low)5d CVE-2026-179536.5 MED

13.2%

——4Insufficient policy enforcement in WebView in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)5d CVE-2026-178216.5 MED

6.8%

——2Insufficient policy enforcement in Extensions in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted Chrome Extension. (Chromium security severity: Medium)5d