Integer overflow in CredentialProvider in Google Chrome on Windows prior to 149

CVE-2026-11058 is an integer overflow in Chrome's CredentialProvider code path on Windows only, fixed in Chrome 149.0.7827.53/54 for Windows/Mac and 149.0.7827.53 for Linux, with this specific bug affecting Windows builds prior to 149.0.7827.53. The public description says the attacker must have already compromised the renderer process; in practical terms, this is not the bug that gets you in from the internet, it is the bug that may help turn a renderer foothold into a sandbox/OS-level escalation.

Reality is lower than a generic 7.5. The decisive friction is the prerequisite chain: unauthenticated remote access is not enough. The attacker needs a separate renderer exploit first, the target must be on Windows, the victim must still be on a vulnerable Chrome build, and the exploit must successfully traverse a browser-to-OS boundary. Google's own Chrome advisory classifies this issue as Medium Chromium severity, which fits operational reality better than a flat HIGH label.

Why this verdict

• Major prerequisite drag: the attacker needs renderer compromise first, which implies a separate initial exploit stage before this CVE even matters
• Population narrowing: Windows-only CredentialProvider code means this does not apply to macOS/Linux browser fleets, cutting enterprise exposure immediately
• Weak threat signals: no KEV listing, no public PoC found, and a very low EPSS all argue against urgent weaponization pressure
• Vendor reality check: Google's own Chrome release classified CVE-2026-11058 as *Medium* Chromium severity, which better matches the exploit friction than a generic 7.5 HIGH

Why not higher?

It is not higher because this is not a one-bug remote takeover from the internet. Requiring both user interaction and a separate successful renderer compromise compounds friction hard, and each prerequisite shrinks the number of real deployments an attacker can hit at scale.

Why not lower?

It is not lower because if an attacker already has renderer execution, this bug can materially increase blast radius by helping cross the sandbox boundary on Windows endpoints. Chrome is massively deployed, so even post-compromise chain components deserve disciplined patch hygiene.

1. Verify Chrome auto-update is not pinned or broken — For a MEDIUM verdict there is no mitigation SLA, so use this as immediate hygiene while you move to patch. Check GPOs, Omaha/Google Update settings, and any version pinning that would strand Windows endpoints below 149.0.7827.53.
2. Prioritize browser exploit telemetry on Windows endpoints — Because exploitation needs a renderer foothold first, the most useful temporary control is catching the *first* stage. Ensure EDR, browser crash reporting, and detections for suspicious chrome.exe child-process behavior are enabled while remediation proceeds; there is no mitigation SLA, but do it opportunistically now.
3. Reduce risky browser reach — Use existing web filtering, SmartScreen/Safe Browsing policies, and extension controls to suppress the likelihood of the upstream renderer exploit stage. This does not replace patching, but it reduces the probability the chain ever reaches CVE-2026-11058.
4. Inventory vulnerable Windows browsers — Pull managed Chrome version data from the Admin console or endpoint inventory and isolate hosts below 149.0.7827.53. With no mitigation SLA, the practical move is to find the laggards and feed them into normal browser remediation rather than declare an incident.

Run this on the target Windows endpoint or through your RMM/SCCM/Intune script runner. Example: powershell -ExecutionPolicy Bypass -File .\check-chrome-cve-2026-11058.ps1; standard user rights are usually enough to read Chrome file and registry version data, but local admin helps in locked-down environments.

# check-chrome-cve-2026-11058.ps1

# Purpose: Determine whether Google Chrome on Windows is vulnerable to CVE-2026-11058

# Logic: Chrome versions earlier than 149.0.7827.53 are VULNERABLE

# Output: VULNERABLE / PATCHED / UNKNOWN

# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN


param()

$ErrorActionPreference = 'SilentlyContinue'
$fixedVersion = [version]'149.0.7827.53'

function Get-ChromeVersionFromPath {
    param([string]$Path)
    if (Test-Path $Path) {
        try {
            $item = Get-Item $Path
            if ($item.VersionInfo -and $item.VersionInfo.FileVersion) {
                return [version]$item.VersionInfo.FileVersion
            }
        } catch {}
    }
    return $null
}

function Get-ChromeVersionFromRegistry {
    $regPaths = @(
        'HKLM:\SOFTWARE\Google\Chrome\BLBeacon',
        'HKLM:\SOFTWARE\WOW6432Node\Google\Chrome\BLBeacon',
        'HKCU:\Software\Google\Chrome\BLBeacon'
    )

    foreach ($reg in $regPaths) {
        try {
            $ver = (Get-ItemProperty -Path $reg -Name version).version
            if ($ver) {
                return [version]$ver
            }
        } catch {}
    }
    return $null
}

$paths = @(
    "$env:ProgramFiles\Google\Chrome\Application\chrome.exe",
    "$env:ProgramFiles(x86)\Google\Chrome\Application\chrome.exe",
    "$env:LocalAppData\Google\Chrome\Application\chrome.exe"
)

$foundVersions = New-Object System.Collections.Generic.List[object]

foreach ($p in $paths) {
    $v = Get-ChromeVersionFromPath -Path $p
    if ($v -ne $null) {
        $foundVersions.Add([pscustomobject]@{ Source = $p; Version = $v })
    }
}

$regVersion = Get-ChromeVersionFromRegistry
if ($regVersion -ne $null) {
    $foundVersions.Add([pscustomobject]@{ Source = 'Registry'; Version = $regVersion })
}

if ($foundVersions.Count -eq 0) {
    Write-Output 'UNKNOWN - Google Chrome not found or version unreadable'
    exit 2
}

# Pick the highest discovered version to avoid false vulnerable when multiple channels/installs exist

$effective = $foundVersions | Sort-Object Version -Descending | Select-Object -First 1

Write-Output ("Detected Chrome version: {0} (source: {1})" -f $effective.Version, $effective.Source)

if ($effective.Version -lt $fixedVersion) {
    Write-Output 'VULNERABLE'
    exit 1
} elseif ($effective.Version -ge $fixedVersion) {
    Write-Output 'PATCHED'
    exit 0
} else {
    Write-Output 'UNKNOWN'
    exit 2
}

Sources

1. Google Chrome Releases - Stable Channel Update for Desktop (June 2, 2026)
2. Canadian Centre for Cyber Security AV26-544
3. CISA Known Exploited Vulnerabilities Catalog
4. FIRST EPSS User Guide
5. FIRST EPSS API documentation
6. Chrome Enterprise - View Chrome version details
7. Chrome Enterprise - Manage Chrome updates (Windows)
8. InfoProtección CVE listing with full description snippet