Out of bounds read in ANGLE in Google Chrome on Linux prior to 149

CVE-2026-11051 is an out-of-bounds read in Chrome's ANGLE graphics layer affecting Google Chrome on Linux before 149.0.7827.53. A victim has to render attacker-controlled web content, and the likely outcome is memory disclosure from the affected process, not code execution or a sandbox escape. The CVE text and vendor vector both point to a crafted HTML page as the trigger, with confidentiality impact only.

Google's MEDIUM / 6.5 label is basically fair in product space, but for enterprise patch triage this lands lower because the attack chain is narrow in practice: Linux only, user interaction required, information leak only, and browser hardening like sandboxing and Site Isolation reduces blast radius. No KEV listing, no active exploitation evidence, and the supplied EPSS 0.00035 all argue against treating this like an emergency.

Why this verdict

• Linux-only population cut: vendor severity assumes the product matters; enterprise exposure drops materially when the vulnerable slice is only Linux Chrome endpoints.
• User interaction required: attacker position is not unauthenticated direct-to-host exploitation; they need the victim to browse to hostile content, which implies phishing/ad-tech/compromised-site delivery and gives email/web controls a chance to stop it.
• Disclosure, not takeover: the CVSS vector has confidentiality-only impact with no integrity or availability loss, so this is not a one-bug workstation compromise story.
• Browser hardening matters: Chrome sandboxing and Site Isolation apply real downward pressure by constraining cross-site data exposure and containing many renderer-class failures.
• Threat intel is quiet: no KEV listing, no confirmed public exploitation, and the supplied EPSS 0.00035 all say attackers are not prioritizing this right now.

Why not higher?

To justify MEDIUM or HIGH in a 10,000-host patch queue, I would want one of three amplifiers: active exploitation, broader platform reach, or impact beyond memory disclosure. This CVE has none of them in the cited record. It is also not externally scannable infrastructure; it only matters where users actively browse hostile content on affected Linux Chrome builds.

Why not lower?

It is still a remotely triggerable memory-safety flaw in a heavily exposed application class: the browser. Confidential data leakage from browser process memory can matter, especially on developer or admin Linux workstations with sensitive sessions open. So this is not 'ignore'; it belongs in normal browser maintenance.

1. Force browser auto-update — Make sure Linux endpoints receive Chrome 149.0.7827.53 or later through your normal browser/package channel. For a LOW verdict there is no SLA (treat as backlog hygiene), but do not let unmanaged developer workstations drift indefinitely because browser bugs age badly.
2. Restrict risky browsing paths — Use secure web gateway, DNS filtering, and phishing controls to reduce the chance users land on attacker HTML. This is useful immediately because the exploit requires page delivery and remains worthwhile even if patch rollout is routine for a LOW finding.
3. Prioritize high-value Linux users — If you have Linux admin, engineering, or cloud-ops workstations, patch those first because browser-resident credentials and cloud sessions are more valuable there. Even without a mitigation SLA for LOW, targeted prioritization improves risk reduction per hour spent.
4. Harden session value — Shorten token lifetime where practical, require reauthentication for sensitive apps, and keep MFA enforcement tight. That limits the payoff of any browser memory disclosure if patching lags.

Run this on the target Linux endpoint or through your fleet agent as a regular user; root is not required unless your tooling limits package queries. Save as check-chrome-cve-2026-11051.sh and run bash check-chrome-cve-2026-11051.sh.

#!/usr/bin/env bash
# Check Google Chrome on Linux for CVE-2026-11051
# Affected: Google Chrome on Linux prior to 149.0.7827.53
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

FIXED_VERSION="149.0.7827.53"

have_cmd() {
  command -v "$1" >/dev/null 2>&1
}

ver_lt() {
  # returns 0 if $1 < $2
  [ "$(printf '%s\n%s\n' "$1" "$2" | sort -V | head -n1)" != "$2" ] && return 1
  [ "$1" = "$2" ] && return 1
  return 0
}

extract_version() {
  # Pull first dotted numeric version from input
  echo "$1" | grep -Eo '[0-9]+(\.[0-9]+){2,}' | head -n1
}

chrome_version=""
source_name=""

for bin in google-chrome-stable google-chrome chrome chromium-browser chromium; do
  if have_cmd "$bin"; then
    out="$($bin --version 2>/dev/null || true)"
    ver="$(extract_version "$out")"
    if [ -n "$ver" ]; then
      chrome_version="$ver"
      source_name="$bin"
      break
    fi
  fi
done

# Prefer Google Chrome package metadata if binary lookup failed or found Chromium
if [ -z "$chrome_version" ] || [ "$source_name" = "chromium" ] || [ "$source_name" = "chromium-browser" ]; then
  if have_cmd dpkg-query; then
    out="$(dpkg-query -W -f='${Version}\n' google-chrome-stable 2>/dev/null | head -n1 || true)"
    ver="$(extract_version "$out")"
    if [ -n "$ver" ]; then
      chrome_version="$ver"
      source_name="dpkg:google-chrome-stable"
    fi
  fi
fi

if [ -z "$chrome_version" ]; then
  if have_cmd rpm; then
    out="$(rpm -q --qf '%{VERSION}-%{RELEASE}\n' google-chrome-stable 2>/dev/null | head -n1 || true)"
    ver="$(extract_version "$out")"
    if [ -n "$ver" ]; then
      chrome_version="$ver"
      source_name="rpm:google-chrome-stable"
    fi
  fi
fi

if [ -z "$chrome_version" ]; then
  echo "UNKNOWN: Google Chrome on Linux not found, or version could not be determined."
  exit 2
fi

# This CVE is stated for Google Chrome on Linux. Chromium package versions may not map cleanly.
case "$source_name" in
  chromium|chromium-browser)
    echo "UNKNOWN: Detected $source_name version $chrome_version. CVE scope is Google Chrome on Linux; verify Chromium downstream backports separately."
    exit 2
    ;;
esac

if ver_lt "$chrome_version" "$FIXED_VERSION"; then
  echo "VULNERABLE: Detected $source_name version $chrome_version, which is earlier than fixed version $FIXED_VERSION."
  exit 1
fi

if [ "$chrome_version" = "$FIXED_VERSION" ] || [ "$(printf '%s\n%s\n' "$FIXED_VERSION" "$chrome_version" | sort -V | tail -n1)" = "$chrome_version" ]; then
  echo "PATCHED: Detected $source_name version $chrome_version, which is at or above fixed version $FIXED_VERSION."
  exit 0
fi

echo "UNKNOWN: Unable to compare detected version $chrome_version against fixed version $FIXED_VERSION."
exit 2

Sources

1. NVD CVE-2026-11051
2. Chrome Releases: Stable Channel Update for Desktop (Chrome 149 stable)
3. Chromium issue 498828605
4. Chromium Security
5. Chromium Site Isolation
6. FIRST EPSS API documentation
7. CISA Known Exploited Vulnerabilities Catalog