Insufficient validation of untrusted input in GPU in Google Chrome on Windows prior to 149

CVE-2026-11021 is a Chrome *GPU/Viz trust-boundary* bug on Windows before 149.0.7827.53. Public Chromium release notes classify it as *insufficient validation of untrusted input in GPU*, and the linked fix for bug 497487755 adds validation during deserialization of renderer-supplied TextureQuad geometry. In plain English: browser-side code was trusting renderer-originated graphics data too much.

The vendor's own *Chromium security severity: Medium* is basically right. The decisive friction is that this is not a clean internet-to-compromise bug; it is a *post-renderer* primitive, meaning the attacker first needs a separate renderer compromise and only then can try to drive this bug for additional impact. That sharply narrows both the reachable population and the number of real-world attack chains that can weaponize it.

Why this verdict

• Starts post-initial-access: the attacker needs a *separate renderer compromise first*, so this is not a one-bug internet-to-host event.
• Windows-only scope: affected population is narrower than the overall Chrome estate because macOS and Linux are out.
• Vendor severity is already Medium: Chrome itself did not flag this as a high/critical standalone issue, which fits the trust-boundary-but-chained nature of the bug.
• Low weaponization signals: no KEV, no public PoC found, and the supplied 0.00047 EPSS is near the floor.
• Blast radius is endpoint-local: compromise value can still be serious for a user session, but it does not expose a server-side shared service or mass unauthenticated attack surface.

Why not higher?

Because the exploit chain assumes the attacker already controls the renderer, this vulnerability is missing the most important step that makes browser bugs operationally urgent: *initial code execution from normal browsing*. Without active exploitation, KEV status, or a public chain, there is not enough evidence to push this into HIGH on a 10,000-host prioritization board.

Why not lower?

It still sits inside one of the most exposed applications in the enterprise, and the fix lands on a renderer-to-browser trust boundary in graphics code, which is exactly the sort of place exploit chains look for escape primitives. If an attacker already has renderer control on a Windows endpoint, this bug may help them turn a contained foothold into something more durable.

1. Force Chrome auto-update compliance — Use enterprise policy and software distribution to eliminate stuck Windows clients. For a MEDIUM call there is no noisgate mitigation SLA; treat this as hygiene while you work the patch through the remediation window.
2. Prioritize Windows browser inventory — This CVE is Windows-specific, so do not waste cycles chasing macOS/Linux noise. Build a clean list of chrome.exe versions on managed Windows endpoints and close exceptions before they become long-tail debt; for MEDIUM, there is no mitigation SLA.
3. Hunt browser exploit telemetry — Watch for repeated Chrome GPU/Viz crashes, exploit protection hits, and suspicious browser child-process behavior on Windows. This will not patch the bug, but it can catch chained exploitation attempts while you complete remediation; again, no mitigation SLA applies at MEDIUM.
4. Reduce unmanaged browsing paths — Where practical, steer users away from unmanaged local admin installs, stale portable builds, and alternate update channels that drift from enterprise policy. This is mainly to kill stragglers that version-based reporting often misses; no mitigation SLA applies for this severity.

Run this on the target Windows endpoint or through your EDR/management tooling with standard user rights; admin is not required unless your environment blocks access to Program Files. Example: powershell -ExecutionPolicy Bypass -File .\check-chrome-cve-2026-11021.ps1. The script checks common Chrome install paths and reports VULNERABLE, PATCHED, or UNKNOWN against the Windows fix level 149.0.7827.53.

# check-chrome-cve-2026-11021.ps1

# Checks Google Chrome on Windows for CVE-2026-11021 exposure.

# Vulnerable if installed version is lower than 149.0.7827.53.

# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN


$ErrorActionPreference = 'SilentlyContinue'

function Get-InstalledChromePaths {
    $paths = @(
        "$env:ProgramFiles\Google\Chrome\Application\chrome.exe",
        "$env:ProgramFiles(x86)\Google\Chrome\Application\chrome.exe",
        "$env:LocalAppData\Google\Chrome\Application\chrome.exe"
    )

    $regPaths = @(
        'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe',
        'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe',
        'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe'
    )

    foreach ($rp in $regPaths) {
        $val = (Get-ItemProperty -Path $rp).'(default)'
        if ($val) { $paths += $val }
    }

    $paths | Where-Object { $_ -and (Test-Path $_) } | Select-Object -Unique
}

function Get-VersionObject([string]$v) {
    try {
        return [version]$v
    } catch {
        return $null
    }
}

$fixedVersion = Get-VersionObject '149.0.7827.53'
$chromePaths = Get-InstalledChromePaths

if (-not $chromePaths -or $chromePaths.Count -eq 0) {
    Write-Output 'UNKNOWN - chrome.exe not found in standard paths or registry.'
    exit 2
}

$results = @()
foreach ($path in $chromePaths) {
    $file = Get-Item $path
    if (-not $file) { continue }

    $prodVersion = $file.VersionInfo.ProductVersion
    if (-not $prodVersion) { $prodVersion = $file.VersionInfo.FileVersion }
    if (-not $prodVersion) {
        $results += [pscustomobject]@{ Path = $path; Version = $null; State = 'UNKNOWN' }
        continue
    }

    $verObj = Get-VersionObject $prodVersion
    if (-not $verObj) {
        $results += [pscustomobject]@{ Path = $path; Version = $prodVersion; State = 'UNKNOWN' }
        continue
    }

    if ($verObj -lt $fixedVersion) {
        $results += [pscustomobject]@{ Path = $path; Version = $prodVersion; State = 'VULNERABLE' }
    } else {
        $results += [pscustomobject]@{ Path = $path; Version = $prodVersion; State = 'PATCHED' }
    }
}

if ($results.Count -eq 0) {
    Write-Output 'UNKNOWN - unable to determine Chrome version.'
    exit 2
}

$results | ForEach-Object {
    Write-Output ("{0} - {1} - {2}" -f $_.State, $_.Version, $_.Path)
}

if ($results.State -contains 'VULNERABLE') {
    exit 1
}
elseif ($results.State -contains 'PATCHED') {
    exit 0
}
else {
    exit 2
}

Sources

1. Chrome Stable Channel Update for Desktop (Chrome 149)
2. Chrome Early Stable Update for Desktop
3. Chromium fix tied to bug 497487755
4. CISA Known Exploited Vulnerabilities Catalog
5. FIRST EPSS data documentation
6. Canadian Centre for Cyber Security advisory AV26-544
7. Chrome Releases archive / 2026 index