Inappropriate implementation in Extensions in Google Chrome prior to 149

CVE-2026-11020 is an Extensions implementation flaw in Google Chrome that affects versions prior to 149.0.7827.53. Google’s public advisory classifies it as an issue that can let a remote attacker leak cross-origin data via attacker-controlled web content; the affected population is essentially desktop Chrome installs that have not yet updated to the fixed 149 build.

Reality check: this is important, but it is not an all-hands fire. The attacker still needs to drive a victim into rendering malicious content in a vulnerable browser, and the public record points to confidentiality loss, not clean RCE or a sandbox escape. With no KEV, no public exploitation evidence, no public PoC, and a very low EPSS, the right enterprise reading is ASSESSED AT MEDIUM, not panic-tier.

Why this verdict

• UI-required delivery lowers the score: the attacker needs a user to browse attacker-controlled content; this is not an unauthenticated network service exploit
• Confidentiality-focused impact, not host takeover: the public description points to cross-origin data leakage, which matters, but it is materially narrower than code execution or sandbox escape
• No exploitation signals: no KEV listing, no public PoC, and the supplied EPSS 0.00035 all push downward from any hypothetical worst-case browser severity
• Client-side population is broad, but reachable exposure is narrower: Chrome is everywhere, yet only users on vulnerable builds who hit malicious content are in play
• Enterprise controls can blunt payoff: application session controls, short-lived tokens, conditional access, browser isolation, and web filtering all reduce the real-world blast radius after successful leakage

Why not higher?

There is no public evidence that this bug yields code execution, sandbox escape, or zero-click compromise. The attacker must first win browser interaction and then get useful data out of the victim’s authenticated context, which is a meaningful chain with real friction.

Why not lower?

Cross-origin isolation is a serious browser trust boundary, and a remote website that can read data across that boundary is not just hygiene noise. Chrome’s deployment scale means even a medium-confidence data leak can matter broadly if you have large unmanaged or slow-updating browser populations.

1. Enforce browser auto-update — Make sure managed endpoints are actually accepting Chrome stable updates and not pinned below 149.0.7827.53. For a MEDIUM verdict there is no mitigation SLA, but this is still the cleanest control because browser fleet drift is what keeps this bug alive.
2. Block risky browsing paths — Use secure web gateway, DNS filtering, Safe Browsing enforcement, or remote browser isolation for high-risk user groups to reduce the chance that attacker-controlled pages get rendered. There is no mitigation SLA — go straight to the 365-day remediation window, but these controls are worth tightening immediately if you have slow patch rings.
3. Harden session reuse — Prefer short-lived sessions, conditional access, step-up MFA for sensitive apps, and device-bound auth where available so leaked browser-side context is harder to replay. This reduces real business impact even if the browser bug is triggered.
4. Inventory version laggards — Find endpoints still below 149.0.7827.53 and map them to business owners. In a 10,000-host fleet, the problem is usually not the patch existing; it is the unmanaged or pinned population.

Run this on the target endpoint or through your endpoint management agent, not from an auditor workstation. Invoke it with python3 chrome_cve_2026_11020_check.py on macOS/Linux or py chrome_cve_2026_11020_check.py on Windows; no admin rights are required if Chrome is installed in standard locations.

#!/usr/bin/env python3
# CVE-2026-11020 local exposure check for Google Chrome
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN

import os
import platform
import re
import subprocess
import sys
from shutil import which

FIXED = (149, 0, 7827, 53)


def parse_version(text):
    if not text:
        return None
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def cmp_ver(a, b):
    return (a > b) - (a < b)


def run_cmd(cmd):
    try:
        p = subprocess.run(cmd, capture_output=True, text=True, timeout=10)
        out = (p.stdout or '') + (p.stderr or '')
        return out.strip()
    except Exception:
        return ''


def get_windows_versions():
    versions = []
    candidates = [
        os.path.expandvars(r'%ProgramFiles%\Google\Chrome\Application\chrome.exe'),
        os.path.expandvars(r'%ProgramFiles(x86)%\Google\Chrome\Application\chrome.exe'),
        os.path.expandvars(r'%LocalAppData%\Google\Chrome\Application\chrome.exe'),
    ]
    for path in candidates:
        if path and os.path.exists(path):
            out = run_cmd([
                'powershell', '-NoProfile', '-Command',
                f"(Get-Item '{path}').VersionInfo.ProductVersion"
            ])
            ver = parse_version(out)
            if ver:
                versions.append((path, ver))
    return versions


def get_macos_versions():
    versions = []
    candidates = [
        '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
        os.path.expanduser('~/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'),
    ]
    for path in candidates:
        if os.path.exists(path):
            out = run_cmd([path, '--version'])
            ver = parse_version(out)
            if ver:
                versions.append((path, ver))
    return versions


def get_linux_versions():
    versions = []
    bins = ['google-chrome', 'google-chrome-stable', 'chromium', 'chromium-browser']
    seen = set()
    for b in bins:
        p = which(b)
        if p and p not in seen:
            seen.add(p)
            out = run_cmd([p, '--version'])
            ver = parse_version(out)
            if ver:
                versions.append((p, ver))
    return versions


def main():
    system = platform.system().lower()
    if 'windows' in system:
        versions = get_windows_versions()
    elif 'darwin' in system:
        versions = get_macos_versions()
    else:
        versions = get_linux_versions()

    if not versions:
        print('UNKNOWN - Google Chrome not found or version could not be determined')
        sys.exit(2)

    vulnerable = []
    patched = []
    for path, ver in versions:
        if cmp_ver(ver, FIXED) < 0:
            vulnerable.append((path, ver))
        else:
            patched.append((path, ver))

    if vulnerable:
        for path, ver in vulnerable:
            print(f'VULNERABLE - {path} version {".".join(map(str, ver))} < {".".join(map(str, FIXED))}')
        sys.exit(1)

    for path, ver in patched:
        print(f'PATCHED - {path} version {".".join(map(str, ver))} >= {".".join(map(str, FIXED))}')
    sys.exit(0)


if __name__ == '__main__':
    main()

Sources

1. Google Chrome Releases - Stable Channel Update for Desktop (June 2, 2026)
2. Chrome stable updates label page showing CVE-2026-11020 severity listing
3. Chromium issue 497440270
4. CISA Known Exploited Vulnerabilities Catalog
5. CISA KEV JSON feed
6. FIRST EPSS overview
7. FIRST EPSS API documentation
8. Chrome Security Page