Inappropriate implementation in Password Manager in Google Chrome prior to 149

CVE-2026-11032 is a Chrome Password Manager flaw that affects builds before 149.0.7827.53 on Linux and 149.0.7827.53/.54 on Windows/macOS. Per the vendor description and your intel, a malicious site can trigger cross-origin data leakage from Password Manager logic, which turns a normal web visit into a same-browser privacy boundary failure rather than full code execution or full browser compromise.

Google’s MEDIUM call is basically right. The impact is sensitive because Password Manager touches credentials and identity data, but the real-world chain still depends on user interaction, a vulnerable browser version, and a page that can actually reach the buggy state; that is a very different operational problem from a no-click RCE or a server-side pre-auth bug attackers can spray across the internet.

Why this verdict

• Starts below panic level: vendor scored it 6.5 MEDIUM, and the bug class is information disclosure rather than code execution or sandbox escape.
• UI requirement is real downward pressure: the attacker needs a user to open hostile web content, which implies phishing, malvertising, or site compromise rather than direct reachability.
• Client-side only: there is no internet-facing daemon to scan and mass-exploit; your exposed surface is only the subset of endpoints lagging Chrome updates.
• Blast radius is bounded: even if hit, the described impact is cross-origin data leakage from Password Manager behavior, not arbitrary code execution on the host.
• Threat intel is cold: EPSS is extremely low, there is no KEV listing, and no public PoC or campaign evidence surfaced in the reviewed sources.

Why not higher?

It is not higher because every important prerequisite narrows the attack set: vulnerable Chrome version, a live user session, a lure to attacker-controlled content, and a working Password Manager state. That compounding friction makes this materially less urgent than pre-auth RCEs, browser sandbox escapes, or anything already showing exploitation telemetry.

Why not lower?

It is not lower because Password Manager is high-value data territory, and cross-origin leakage inside a browser can translate into credential exposure or origin boundary bypass consequences. Chrome is also massively deployed, so even a moderate-probability client bug can matter at enterprise fleet scale if patch hygiene is weak.

1. Force browser update compliance — Use your endpoint platform or browser management tooling to drive all desktop Chrome installs to 149.0.7827.53+ immediately and identify stragglers. For a MEDIUM verdict there is no mitigation SLA — go straight to the 365-day remediation window, but in practice browser fleet hygiene should be measured in days, not quarters.
2. Restrict password manager use on high-risk tiers — For admin workstations, privileged access tiers, and help-desk jump boxes, enforce policy to disable built-in password saving/autofill or move those roles to hardened credential workflows. This reduces the available secret material if a similar browser-origin flaw is hit before patching; deploy as a preventive control during the normal remediation cycle.
3. Harden web content delivery paths — Keep Safe Browsing, URL filtering, browser isolation, and mail-link rewriting enabled because they reduce the odds users ever land on the crafted page needed for exploitation. This does not fix the bug, but it does cut the only viable initial access path while you complete patch rollout.
4. Find stale Chrome on exception populations — Audit VDI gold images, kiosk systems, offline laptops, developer workstations using portable builds, and lab machines where Chrome auto-update is often broken by design. These are the systems that turn a medium browser bug into a recurring long-tail exposure.

Run this on the target endpoint or through your EDR live-response / software inventory runner. Invoke with python3 check_chrome_cve_2026_11032.py on macOS/Linux or py check_chrome_cve_2026_11032.py on Windows; standard user rights are usually enough, though Windows registry access works best in a normal user or admin session.

#!/usr/bin/env python3
# check_chrome_cve_2026_11032.py
# Detects whether installed Google Chrome is older than 149.0.7827.53
# Outputs exactly one of: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import shutil
import subprocess
import sys

THRESHOLD = (149, 0, 7827, 53)


def parse_version(text):
    if not text:
        return None
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def version_lt(a, b):
    return a < b


def run_cmd(cmd):
    try:
        p = subprocess.run(cmd, capture_output=True, text=True, timeout=10)
        out = (p.stdout or '') + ' ' + (p.stderr or '')
        return out.strip()
    except Exception:
        return ''


def get_version_from_binary(path):
    if not path or not os.path.exists(path):
        return None
    out = run_cmd([path, '--version'])
    return parse_version(out)


def detect_linux():
    candidates = [
        shutil.which('google-chrome'),
        shutil.which('google-chrome-stable'),
        shutil.which('chrome'),
        '/opt/google/chrome/chrome',
        '/usr/bin/google-chrome',
        '/usr/bin/google-chrome-stable',
    ]
    for c in candidates:
        v = get_version_from_binary(c)
        if v:
            return v
    return None


def detect_macos():
    candidates = [
        '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
        os.path.expanduser('~/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'),
    ]
    for c in candidates:
        v = get_version_from_binary(c)
        if v:
            return v
    return None


def detect_windows():
    # Try common install paths first
    env_paths = [
        os.environ.get('PROGRAMFILES'),
        os.environ.get('PROGRAMFILES(X86)'),
        os.environ.get('LOCALAPPDATA'),
    ]
    candidates = []
    for base in env_paths:
        if not base:
            continue
        candidates.append(os.path.join(base, 'Google', 'Chrome', 'Application', 'chrome.exe'))

    for c in candidates:
        if os.path.exists(c):
            out = run_cmd([c, '--version'])
            v = parse_version(out)
            if v:
                return v

    # Fallback to registry query without requiring pywin32
    reg_queries = [
        [
            'reg', 'query',
            r'HKCU\Software\Google\Chrome\BLBeacon',
            '/v', 'version'
        ],
        [
            'reg', 'query',
            r'HKLM\Software\Google\Chrome\BLBeacon',
            '/v', 'version'
        ],
        [
            'reg', 'query',
            r'HKLM\Software\WOW6432Node\Google\Chrome\BLBeacon',
            '/v', 'version'
        ],
    ]
    for q in reg_queries:
        out = run_cmd(q)
        v = parse_version(out)
        if v:
            return v

    return None


def main():
    system = platform.system().lower()
    version = None

    if 'windows' in system:
        version = detect_windows()
    elif 'darwin' in system:
        version = detect_macos()
    elif 'linux' in system:
        version = detect_linux()
    else:
        print('UNKNOWN')
        sys.exit(2)

    if not version:
        print('UNKNOWN')
        sys.exit(2)

    if version_lt(version, THRESHOLD):
        print('VULNERABLE')
        sys.exit(1)
    else:
        print('PATCHED')
        sys.exit(0)


if __name__ == '__main__':
    main()

Sources

1. Google Chrome Releases — Stable Channel Update for Desktop (Chrome 149)
2. Google Chrome Releases — Early Stable Update for Desktop
3. Canadian Centre for Cyber Security advisory for Chrome 149
4. SecurityWeek summary of Chrome 149 fixes
5. CISA Known Exploited Vulnerabilities Catalog
6. FIRST EPSS API documentation
7. Chromium Chrome Security Page
8. Chrome Releases index for 2026