Insufficient validation of untrusted input in SiteIsolation in Google Chrome on Windows prior to 149

CVE-2026-11056 affects Google Chrome on Windows prior to 149.0.7827.53. The flaw sits in Site Isolation, and the key clause in the official description matters more than the scary CVSS math: the attacker must have already compromised the renderer process and then use a crafted HTML page to try to turn that foothold into a sandbox escape.

That makes the raw 9.6 label misleading for patch triage. Chromium's own security severity is Medium, while NVD's CISA-ADP overlay scores it 9.6 Critical; for defenders, the real-world story is a second-stage exploit primitive, not a one-click internet-to-host compromise. Wide browser deployment keeps it relevant, but the need for a separate renderer exploit is a massive downward pressure on urgency.

Why this verdict

• Start at 9.6, then cut hard because this is post-renderer-compromise: the official description requires the attacker to have *already compromised the renderer process*, which implies a separate exploit stage before CVE-2026-11056 contributes anything.
• Windows-only scope narrows the reachable population: even in Chrome-heavy shops, this excludes non-Windows fleets and cuts down chain portability.
• No exploitation heat: not in KEV, no public PoC found, and the supplied EPSS of 0.00047 is consistent with low short-term attacker interest.
• Still not low: if you are already dealing with a browser chain, a sandbox escape is exactly the kind of primitive that turns a web compromise into an endpoint incident.

Why not higher?

Because this is not a one-bug remote compromise. It requires attacker-controlled content, user interaction, and—most importantly—a separate successful renderer compromise before the Site Isolation flaw becomes useful. That compounding friction is too much to justify HIGH or CRITICAL as a standalone patching emergency.

Why not lower?

Because the affected product is one of the most widely deployed user applications in the enterprise, and sandbox escapes are high-value chain amplifiers. If an attacker already has renderer execution, this bug can materially change the outcome from browser containment to host impact, so it does not belong in backlog hygiene.

1. Enforce browser auto-update compliance — Use GPO, Chrome Enterprise policy, or your endpoint management stack to verify Windows endpoints are taking Chrome updates and are not pinned below 149.0.7827.53. For a MEDIUM verdict there is no mitigation SLA; focus on normalizing version drift and complete remediation within 365 days.
2. Prioritize high-risk browsing populations — Check developer workstations, privileged admin endpoints, research teams, and users with broad web access first, because a sandbox escape matters most where hostile content is common and credentials are valuable. There is no mitigation SLA for this bucket, but use this control immediately if patch lag exists while staying inside the 365-day remediation window.
3. Harden browser-to-endpoint pivot paths — Keep EDR exploit prevention, Microsoft Defender ASR rules, WDAC/AppLocker, and least-privilege controls enforced so a successful browser sandbox escape still hits another wall. This does not replace patching, but it reduces the payoff of chained exploitation while you work through standard remediation.
4. Monitor version laggards in endpoint inventory — Track Chrome version posture from EDR, SCCM/Intune, Tanium, BigFix, or equivalent instead of relying on network scanners. For this MEDIUM reassessment, there is no mitigation SLA — go straight to the 365-day remediation window and manage exceptions explicitly.

Run this on the target Windows endpoint or via your endpoint management/remote shell tooling. Invoke it with powershell -ExecutionPolicy Bypass -File .\Test-ChromeCVE-2026-11056.ps1; local admin is recommended so the script can inspect both machine-wide install paths and all users' desktop app installs. It prints VULNERABLE, PATCHED, or UNKNOWN and exits 1, 0, or 2 respectively.

# Test-ChromeCVE-2026-11056.ps1

# Checks Google Chrome version on Windows for CVE-2026-11056

# Vulnerable if any discovered chrome.exe version is lower than 149.0.7827.53

# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN


param()

$ErrorActionPreference = 'SilentlyContinue'
$PatchedVersion = [version]'149.0.7827.53'

function Get-ChromeCandidates {
    $paths = New-Object System.Collections.Generic.List[string]

    $staticPaths = @(
        "$env:ProgramFiles\Google\Chrome\Application\chrome.exe",
        "$env:ProgramFiles(x86)\Google\Chrome\Application\chrome.exe",
        "$env:LocalAppData\Google\Chrome\Application\chrome.exe"
    )

    foreach ($p in $staticPaths) {
        if ($p -and (Test-Path $p)) { [void]$paths.Add($p) }
    }

    # All local user profiles (best-effort)

    $userRoot = Join-Path $env:SystemDrive 'Users'
    if (Test-Path $userRoot) {
        Get-ChildItem -Path $userRoot -Directory | ForEach-Object {
            $candidate = Join-Path $_.FullName 'AppData\Local\Google\Chrome\Application\chrome.exe'
            if (Test-Path $candidate) { [void]$paths.Add($candidate) }
        }
    }

    # Registry uninstall keys (best-effort)

    $regPaths = @(
        'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
        'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*',
        'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*'
    )

    foreach ($rp in $regPaths) {
        Get-ItemProperty -Path $rp | Where-Object {
            $_.DisplayName -match 'Google Chrome' -and $_.InstallLocation
        } | ForEach-Object {
            $candidate = Join-Path $_.InstallLocation 'chrome.exe'
            if (Test-Path $candidate) { [void]$paths.Add($candidate) }
        }
    }

    return $paths | Sort-Object -Unique
}

function Get-FileVersionObject([string]$Path) {
    try {
        $fv = (Get-Item $Path).VersionInfo.FileVersion
        if (-not $fv) { return $null }
        # Normalize any extra suffixes if present

        $match = [regex]::Match($fv, '\d+\.\d+\.\d+\.\d+')
        if (-not $match.Success) { return $null }
        return [version]$match.Value
    }
    catch {
        return $null
    }
}

$candidates = Get-ChromeCandidates

if (-not $candidates -or $candidates.Count -eq 0) {
    Write-Output 'UNKNOWN - Google Chrome executable not found on this host'
    exit 2
}

$results = @()
foreach ($path in $candidates) {
    $ver = Get-FileVersionObject -Path $path
    if ($null -ne $ver) {
        $results += [pscustomobject]@{
            Path = $path
            Version = $ver
            Vulnerable = ($ver -lt $PatchedVersion)
        }
    }
}

if (-not $results -or $results.Count -eq 0) {
    Write-Output 'UNKNOWN - Chrome found but version could not be determined'
    exit 2
}

$vuln = $results | Where-Object { $_.Vulnerable }
if ($vuln) {
    Write-Output 'VULNERABLE'
    $vuln | Sort-Object Version | ForEach-Object {
        Write-Output ("{0} :: {1}" -f $_.Path, $_.Version)
    }
    exit 1
}
else {
    Write-Output 'PATCHED'
    $results | Sort-Object Version | ForEach-Object {
        Write-Output ("{0} :: {1}" -f $_.Path, $_.Version)
    }
    exit 0
}

Sources

1. NVD CVE-2026-11056 detail
2. Chrome Releases: Early Stable Update for Desktop (149.0.7827.53/.54)
3. Chrome Releases: Stable Channel Update for Desktop
4. Chromium security: Site Isolation overview
5. Chromium Site Isolation design document
6. CISA Known Exploited Vulnerabilities Catalog
7. FIRST EPSS overview
8. Censys overview of internet-wide scanning