Stack buffer overflow in Skia in Google Chrome prior to 149

CVE-2026-11024 is a stack buffer overflow in Skia, Chrome's 2D graphics stack, affecting Google Chrome before 149.0.7827.53 on Linux and before 149.0.7827.53/54 on Windows and macOS. The practical trigger is hostile web content rendered by the browser — think a crafted page, image, canvas, or drawing path that steers Skia into corrupting stack memory during rendering.

Reality check: this is serious bug class, moderate enterprise urgency. Unauthenticated remote delivery via the web is the amplifier, but the big brakes are user interaction, exploit reliability on modern Chrome, and the renderer sandbox. Google's own release classifies it as Medium, and that matches the real-world patching story better than the raw phrase *stack buffer overflow* would suggest.

Why this verdict

• Start at serious-but-not-panic: remote memory corruption in a massively deployed browser deserves attention even without a published CVSS.
• Downward adjustment for user-driven delivery: the attacker needs the victim to render hostile content, which implies phishing, malvertising, or site compromise rather than direct unauthenticated service reachability.
• Downward adjustment for sandbox containment: a compromised renderer is dangerous, but Chromium explicitly treats renderer compromise as a contained state; full host compromise usually needs a second bug or additional abuse path.
• Downward adjustment for exploit maturity: no KEV listing, no public PoC, and a floor-level EPSS score mean there is little evidence of current weaponization pressure.
• Not lower because of ubiquity: Chrome is everywhere, web content is a natural delivery mechanism, and stack corruption bugs can become valuable once chained by a capable actor.

Why not higher?

This is not a clean unauthenticated server-side RCE against an exposed enterprise service. The attacker has to win a client-side, user-driven, modern-browser exploitation problem, and then still deal with sandbox escape or accept lower-impact in-sandbox outcomes.

Why not lower?

Calling it LOW would understate the combination of remote reachability via normal web traffic and a genuine memory-corruption primitive in a highly deployed browser. Even with good mitigations, this remains a plausible foothold bug for targeted phishing and exploit-chain work.

1. Keep Chrome auto-update unblocked — Verify Google Update / managed browser update paths are functioning end-to-end so stale browsers do not linger outside policy. For a MEDIUM verdict there is no mitigation SLA, but this is the highest-value control to reduce exposure while you roll routine browser maintenance.
2. Preserve the sandbox — Hunt for unsupported launch flags like --no-sandbox, brittle kiosk wrappers, or local hardening exceptions that weaken renderer isolation. There is no mitigation SLA for MEDIUM issues, but this directly preserves the main friction that kept the verdict out of HIGH.
3. Apply stronger browsing isolation to high-risk users — For admins, finance, executives, and threat-facing teams, route untrusted browsing through remote browser isolation or controlled VDI where feasible. There is no mitigation SLA for MEDIUM issues, so use this as risk reduction where your exposure concentration is highest.
4. Monitor Chrome crash anomalies — Use EDR, browser telemetry, or helpdesk signals to spot clusters of renderer crashes after visits to the same domains or campaigns. There is no mitigation SLA here, but crash correlation is one of the few practical early-warning signals for exploit development against browser memory bugs.

Run this on the target endpoint itself, or push it through your endpoint management runner. Invoke with python3 chrome_cve_2026_11024_check.py on macOS/Linux or py -3 .\chrome_cve_2026_11024_check.py on Windows; no admin rights are required unless your local software inventory is locked down.

#!/usr/bin/env python3
# CVE-2026-11024 Google Chrome version check
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import shutil
import subprocess
import sys

FIXED = (149, 0, 7827, 53)

def parse_version(text):
    if not text:
        return None
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())

def run_version(cmd):
    try:
        p = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True, timeout=5)
        return parse_version(p.stdout)
    except Exception:
        return None

def windows_candidates():
    paths = []
    envs = [os.environ.get('PROGRAMFILES'), os.environ.get('PROGRAMFILES(X86)'), os.environ.get('LOCALAPPDATA')]
    suffixes = [
        r'Google\Chrome\Application\chrome.exe',
    ]
    for base in envs:
        if not base:
            continue
        for suffix in suffixes:
            p = os.path.join(base, *suffix.split('\\'))
            if os.path.exists(p):
                paths.append(p)
    return paths

def mac_candidates():
    return [
        '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
        os.path.expanduser('~/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'),
    ]

def linux_candidates():
    names = ['google-chrome', 'google-chrome-stable', 'chromium', 'chromium-browser']
    found = []
    for name in names:
        p = shutil.which(name)
        if p:
            found.append(p)
    return found

def get_version():
    system = platform.system().lower()
    candidates = []
    if 'windows' in system:
        candidates = windows_candidates()
    elif 'darwin' in system:
        candidates = mac_candidates()
    else:
        candidates = linux_candidates()

    for exe in candidates:
        v = run_version([exe, '--version'])
        if v:
            return exe, v
    return None, None

def main():
    path, version = get_version()
    if not version:
        print('UNKNOWN: Could not determine installed Chrome/Chromium version on this host.')
        sys.exit(2)

    product = os.path.basename(path) if path else 'chrome'
    ver_str = '.'.join(str(x) for x in version)
    fixed_str = '.'.join(str(x) for x in FIXED)

    if version < FIXED:
        print(f'VULNERABLE: {product} version {ver_str} is below fixed version {fixed_str}.')
        sys.exit(1)
    else:
        print(f'PATCHED: {product} version {ver_str} is at or above fixed version {fixed_str}.')
        sys.exit(0)

if __name__ == '__main__':
    main()

Sources

1. Google Chrome Releases - Stable Channel Update for Desktop (Chrome 149)
2. Chrome Releases 2026 archive showing CVE-2026-11024 classification
3. Chromium source commit tied to bug 497591594 (Skia roll with safety checks)
4. Chrome 149 release notes
5. Chromium Sandbox FAQ
6. Chromium docs - Threat model and defenses against compromised renderers
7. CISA Known Exploited Vulnerabilities Catalog
8. FIRST EPSS API