Insufficient validation of untrusted input in Network in Google Chrome prior to 149

CVE-2026-11013 is an *insufficient validation of untrusted input* flaw in Chrome's Network component. Publicly disclosed details are thin, but the affected builds are Chrome prior to 149.0.7827.53 on Linux and prior to 149.0.7827.53/.54 on Windows and macOS, with Google listing it in the Medium bucket in the 2026 Chrome release archive.

Reality check: the scary word here is Network, but the practical story is *not* 'internet-wide RCE on contact.' The public description is truncated after 'allowed a remote attacker who had compromised ...', which strongly implies a chained, post-compromise browser exploit path rather than standalone initial access. With no KEV listing, no public exploitation, no public PoC, a very low EPSS, and no published CVSS from Google/NVD, this lands as a low-priority chain component rather than a fleet-wide fire drill.

Why this verdict

• Requires prior attacker position: the public description is truncated after 'allowed a remote attacker who had compromised ...', which strongly implies a prior renderer or similar foothold, pushing severity down hard.
• Reachable population is narrowed: unlike a perimeter server bug, this cannot be mass-scanned or opportunistically sprayed across internet-facing services; impact depends on vulnerable endpoints *and* a successful browser exploit chain.
• Threat telemetry is cold: no KEV, no public exploitation reporting, no public PoC, and a very low EPSS (0.00047) all argue against emergency handling.

Why not higher?

There is no public evidence that CVE-2026-11013 is a reliable one-click browser takeover by itself. The likely prerequisite of prior renderer compromise compounds downward pressure: requiring a separate bug or compromise stage is exactly why this does not belong in HIGH or CRITICAL.

Why not lower?

It is still a Chrome security flaw in a massively deployed client application, and chain components do matter when paired with other bugs. Google itself categorized it as Medium severity, so fully ignoring it would understate the residual value to capable attackers.

1. Enforce rapid Chrome auto-update — Make sure enterprise policy is not pinning Chrome below the fixed build and verify update rings are healthy. For a LOW verdict there is no SLA beyond backlog hygiene, but this should still be folded into the next normal browser update cycle because browsers are chain-rich targets.
2. Reduce browser exploit blast radius — Keep Chrome sandboxing intact, block unnecessary local admin rights, and maintain EDR coverage on user endpoints so a renderer-stage compromise has fewer paths to become durable compromise. For LOW, handle as routine hardening work rather than emergency change.
3. Watch for crash clusters in Chrome child processes — Use EDR, SIEM, or crash-report telemetry to look for unusual spikes in chrome child-process crashes, especially after exposure to untrusted sites. That will not prove exploitation, but it is one of the few practical signals for browser-chain activity.
4. Prioritize high-risk user groups first — If you cannot verify full fleet patch state quickly, start with internet-facing users, researchers, executives, and help-desk/admin workstations that browse untrusted content more often. Even for LOW, targeted-user populations deserve earlier browser hygiene.

Run this on the target endpoint or through your software inventory/remote execution tool. Invoke it as python3 chrome_cve_2026_11013_check.py on macOS/Linux or py chrome_cve_2026_11013_check.py on Windows; no admin rights are required, but the script only checks locally installed Chrome/Chromium binaries it can access.

#!/usr/bin/env python3
# CVE-2026-11013 Chrome version checker
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import shutil
import subprocess
import sys
from pathlib import Path

TARGETS = {
    'Windows': (149, 0, 7827, 54),
    'Darwin': (149, 0, 7827, 54),
    'Linux': (149, 0, 7827, 53),
}

VERSION_RE = re.compile(r'(\d+)\.(\d+)\.(\d+)\.(\d+)')


def parse_version(text):
    m = VERSION_RE.search(text or '')
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def compare_versions(a, b):
    return (a > b) - (a < b)


def run_and_get_version(cmd):
    try:
        p = subprocess.run(cmd, capture_output=True, text=True, timeout=10)
        out = (p.stdout or '') + ' ' + (p.stderr or '')
        return parse_version(out.strip())
    except Exception:
        return None


def windows_candidates():
    candidates = []
    envs = [
        os.environ.get('ProgramFiles'),
        os.environ.get('ProgramFiles(x86)'),
        os.environ.get('LocalAppData'),
    ]
    suffixes = [
        r'Google\Chrome\Application\chrome.exe',
        r'Chromium\Application\chrome.exe',
    ]
    for base in envs:
        if base:
            for suf in suffixes:
                p = Path(base) / suf
                candidates.append(str(p))
    return candidates


def mac_candidates():
    return [
        '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
        str(Path.home() / 'Applications/Google Chrome.app/Contents/MacOS/Google Chrome'),
        '/Applications/Chromium.app/Contents/MacOS/Chromium',
        str(Path.home() / 'Applications/Chromium.app/Contents/MacOS/Chromium'),
    ]


def linux_candidates():
    names = [
        'google-chrome', 'google-chrome-stable', 'chromium', 'chromium-browser', 'chrome'
    ]
    found = [shutil.which(n) for n in names if shutil.which(n)]
    found += [
        '/opt/google/chrome/chrome',
        '/usr/bin/google-chrome',
        '/usr/bin/google-chrome-stable',
        '/usr/bin/chromium',
        '/usr/bin/chromium-browser',
    ]
    return list(dict.fromkeys([x for x in found if x]))


def get_candidates():
    system = platform.system()
    if system == 'Windows':
        return windows_candidates()
    if system == 'Darwin':
        return mac_candidates()
    return linux_candidates()


def main():
    system = platform.system()
    min_version = TARGETS.get(system)
    if not min_version:
        print('UNKNOWN: unsupported OS {}'.format(system))
        sys.exit(2)

    checked = []
    versions = []
    for binary in get_candidates():
        if not Path(binary).exists():
            continue
        checked.append(binary)
        ver = run_and_get_version([binary, '--version'])
        if ver:
            versions.append((binary, ver))

    if not versions:
        print('UNKNOWN: no Chrome/Chromium binary found or version unreadable')
        if checked:
            print('Checked paths:')
            for p in checked:
                print(' - {}'.format(p))
        sys.exit(2)

    # Pick the highest discovered version in case multiple channels are installed.
    binary, ver = sorted(versions, key=lambda x: x[1], reverse=True)[0]
    status = compare_versions(ver, min_version)

    print('Detected: {} -> {}'.format(binary, '.'.join(map(str, ver))))
    print('Required minimum for {}: {}'.format(system, '.'.join(map(str, min_version))))

    if status >= 0:
        print('PATCHED')
        sys.exit(0)
    else:
        print('VULNERABLE')
        sys.exit(1)


if __name__ == '__main__':
    main()

Sources

1. Chrome Releases 2026 archive entry showing CVE-2026-11013 as Medium and reported by Google
2. Chrome early stable desktop update with fixed version 149.0.7827.53/.54
3. Canadian Centre for Cyber Security advisory with affected version ranges
4. Chromium Security page explaining restricted bug details and stable-release notes as the fixed-bug record
5. CISA Known Exploited Vulnerabilities Catalog
6. FIRST EPSS data documentation
7. FIRST EPSS API documentation