Insufficient policy enforcement in Password Manager in Google Chrome prior to 149

The authoritative public record matching your description appears to be CVE-2026-11193 rather than CVE-2026-11011; it was published on 2026-06-04 and describes *insufficient policy enforcement* in Chrome Password Manager. Affected builds are Chrome before 149.0.7827.53 on Windows/Linux and, per downstream advisories, before 149.0.7827.54 on macOS, with the fix shipped in Google's May 29, 2026 early-stable release.

In real enterprise terms, this is not a perimeter-breaker. It needs a victim on a vulnerable browser to load a crafted HTML page, the impact is constrained to the local browser profile and whatever credentials or policy state are actually present there, and many mature fleets already blunt it by disabling Chrome's built-in password manager or using passwordless/SSO. That makes MEDIUM the right first-call severity even though Chrome is ubiquitous.

Why this verdict

• User interaction is mandatory: attacker position is unauthenticated remote, but only after the victim loads crafted HTML. That immediately pushes this below wormable or perimeter-exposed classes.
• It is post-click and profile-scoped: the prerequisite implies a single-user browser session, not broad network reach. Real deployments compound that friction with web filtering, browser isolation, and Safe Browsing.
• Enterprise password storage habits matter: if PasswordManagerEnabled is off, sensitive domains are blocklisted, or users rely on SSO/passkeys, the reachable population and resulting value drop materially.
• No exploitation evidence: no KEV listing, no active-campaign reporting, and EPSS is extremely low. That keeps urgency in the routine-browser-patching lane instead of incident-response lane.
• Wide deployment keeps it from being LOW: Chrome is everywhere, so even a non-RCE password-manager boundary failure deserves attention once you verify vulnerable builds are present.

Why not higher?

There is no sign of active exploitation, no public exploit recipe in the reviewed sources, and no indication this jumps from one browser profile to broad enterprise compromise. Most importantly, the attacker must first win a lure and then find stored credentials or exploitable password-manager state on that specific endpoint.

Why not lower?

This still touches credential-handling logic inside one of the most widely deployed enterprise clients on earth. If you do allow Chrome's built-in password manager for workforce accounts, the flaw can undermine a policy boundary protecting exactly the data defenders care about.

1. Disable Chrome password saving where business-acceptable — Set PasswordManagerEnabled=false for managed browsers that do not need Chrome's built-in password store. For a MEDIUM verdict there is no mitigation SLA, so this is optional risk reduction rather than an emergency change; use it for higher-risk user groups and shared-workstation populations.
2. Block Password Manager on crown-jewel domains — Use PasswordManagerBlocklist for IdP, admin, finance, and privileged application domains so Chrome does not save/fill credentials there. There is no mitigation SLA for MEDIUM, but this is a sensible control during normal policy maintenance if your users still store browser passwords.
3. Prefer passkeys or phishing-resistant MFA — Shift high-value apps away from reusable passwords so a browser-side password-manager flaw has less to steal or misuse. There is no mitigation SLA for MEDIUM; align this with your identity hardening roadmap rather than treat it as a one-off CVE action.
4. Use browser version reporting aggressively — Pull a versions report from the Admin console or endpoint tooling and isolate all Chrome builds below the fixed floor. For MEDIUM there is no mitigation SLA, but precise version visibility is what keeps this from becoming a blind spot in a 10,000-host fleet.

Run this on the target endpoint or through your EDR/remote execution framework as the logged-in user or a standard local account; admin rights are not required in most cases. Example: python3 check_chrome_cve_2026_11193.py on macOS/Linux or py check_chrome_cve_2026_11193.py on Windows. It checks local Google Chrome version and prints VULNERABLE, PATCHED, or UNKNOWN.

#!/usr/bin/env python3
# check_chrome_cve_2026_11193.py
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN / Chrome not found / parse failure

import os
import platform
import re
import subprocess
import sys
from pathlib import Path

WIN_MIN = (149, 0, 7827, 53)
LINUX_MIN = (149, 0, 7827, 53)
MAC_MIN = (149, 0, 7827, 54)


def parse_ver(s):
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', s or '')
    return tuple(int(x) for x in m.groups()) if m else None


def cmp_ver(a, b):
    return (a > b) - (a < b)


def run_cmd(cmd):
    try:
        p = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, timeout=10)
        if p.returncode == 0:
            return (p.stdout or p.stderr).strip()
    except Exception:
        pass
    return None


def get_windows_version():
    candidates = [
        Path(os.environ.get('ProgramFiles', r'C:\Program Files')) / 'Google/Chrome/Application/chrome.exe',
        Path(os.environ.get('ProgramFiles(x86)', r'C:\Program Files (x86)')) / 'Google/Chrome/Application/chrome.exe',
        Path(os.environ.get('LocalAppData', '')) / 'Google/Chrome/Application/chrome.exe',
    ]
    for exe in candidates:
        if exe.exists():
            cmd = [
                'powershell', '-NoProfile', '-Command',
                f"(Get-Item '{str(exe)}').VersionInfo.ProductVersion"
            ]
            out = run_cmd(cmd)
            if out:
                return out, str(exe)
    return None, None


def get_macos_version():
    candidates = [
        '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
        str(Path.home() / 'Applications/Google Chrome.app/Contents/MacOS/Google Chrome'),
    ]
    for exe in candidates:
        if Path(exe).exists():
            out = run_cmd([exe, '--version'])
            if out:
                return out, exe
    return None, None


def get_linux_version():
    cmds = [
        ['google-chrome', '--version'],
        ['google-chrome-stable', '--version'],
        ['/opt/google/chrome/chrome', '--version'],
    ]
    for cmd in cmds:
        out = run_cmd(cmd)
        if out:
            return out, cmd[0]
    return None, None


def main():
    system = platform.system().lower()

    if 'windows' in system:
        raw, source = get_windows_version()
        min_ver = WIN_MIN
        platform_name = 'Windows'
    elif 'darwin' in system:
        raw, source = get_macos_version()
        min_ver = MAC_MIN
        platform_name = 'macOS'
    elif 'linux' in system:
        raw, source = get_linux_version()
        min_ver = LINUX_MIN
        platform_name = 'Linux'
    else:
        print('UNKNOWN: unsupported platform')
        sys.exit(2)

    if not raw:
        print(f'UNKNOWN: Google Chrome not found on {platform_name}')
        sys.exit(2)

    ver = parse_ver(raw)
    if not ver:
        print(f'UNKNOWN: could not parse Chrome version from: {raw}')
        sys.exit(2)

    if cmp_ver(ver, min_ver) < 0:
        print(f'VULNERABLE: {platform_name} Chrome {ver[0]}.{ver[1]}.{ver[2]}.{ver[3]} found at {source}; requires >= {min_ver[0]}.{min_ver[1]}.{min_ver[2]}.{min_ver[3]}')
        sys.exit(1)
    else:
        print(f'PATCHED: {platform_name} Chrome {ver[0]}.{ver[1]}.{ver[2]}.{ver[3]} found at {source}; meets >= {min_ver[0]}.{min_ver[1]}.{min_ver[2]}.{min_ver[3]}')
        sys.exit(0)


if __name__ == '__main__':
    main()

Sources

1. Google Chrome stable channel desktop advisory
2. CVE-2026-11193 aggregation with CNA, EPSS, CWE, and CISA-ADP details
3. CISA Known Exploited Vulnerabilities Catalog
4. Chrome Enterprise policy: PasswordManagerEnabled
5. Chrome Enterprise policy: PasswordManagerBlocklist
6. Google Chrome Help: Update Google Chrome
7. Chrome Enterprise Admin help: View Chrome version details
8. CERT-FR advisory covering affected desktop version floors