Type Confusion in ANGLE in Google Chrome prior to 149

CVE-2026-11061 is a memory-corruption flaw described as a *type confusion* issue in ANGLE, Chrome’s graphics translation layer used by WebGL and GPU-backed rendering paths. The affected population is Chrome desktop before 149.0.7827.53 on Linux and effectively before 149.0.7827.53/54 on Windows and macOS; in practice, anything below 149.0.7827.53 should be treated as exposed. A remote attacker would need to get a user onto crafted browser content that exercises the vulnerable graphics path.

Google calling this CRITICAL is understandable because browser-to-sandbox-boundary bugs are exactly the bugs offensive teams prize. But for enterprise prioritization, the vendor score overstates urgency: this is still a client-side, user-driven, build-specific exploit with no public exploitation evidence, no KEV listing, and a very low EPSS signal; reliability is also likely to vary across GPU drivers, OS builds, and rendering paths.

Why this verdict

• Start from vendor 9.6 because Chrome is massively deployed and ANGLE memory corruption sits in a prime drive-by attack surface.
• Adjust down for attacker position: this is not internet-reachable server software; it requires a user endpoint running a vulnerable browser build to visit attacker-controlled content.
• Adjust down for user interaction: UI:R is not cosmetic here. Delivery has to survive real-world controls like Safe Browsing, email filtering, ad blocking, and user behavior.
• Adjust down for exploit engineering friction: ANGLE/GPU bugs tend to be backend-, driver-, and platform-sensitive, which narrows the fraction of fleets a single exploit works against reliably.
• Adjust down for threat intel: no KEV listing, no public exploitation evidence found, and an EPSS of 0.00035 do not support a CRITICAL enterprise response.
• Hold at HIGH, not MEDIUM: the advertised impact is a sandbox escape in a ubiquitous browser. If you own an endpoint team, that is still a serious patching problem.

Why not higher?

There is no credible public signal that this bug is being used in the wild right now, and the exploit path is not broadly reachable like a perimeter appliance RCE. The chain also depends on user interaction and likely on platform-specific exploit reliability across GPU stacks, which is exactly the kind of compounding friction that should pull a vendor CRITICAL down one bucket.

Why not lower?

This is still memory corruption in Chrome, one of the highest-value client targets in the enterprise. Even with exploit friction, the reachable population is large, the patch is already out, and a successful browser-to-sandbox-boundary compromise can become a real endpoint incident quickly.

1. Force browser update and restart — Push managed Chrome to 149.0.7827.53+ and enforce restart prompts or maintenance-window restarts. For a HIGH verdict, deploy this control within 30 days; in practice for browsers, do it much faster because version drift is the real exposure multiplier.
2. Quarantine stale endpoints from sensitive apps — Use device posture, MDM, NAC, or EDR policy to identify endpoints still below the fixed version and restrict access to high-value internal apps until updated. Apply this within 30 days to stop unmanaged or rarely rebooted systems from silently carrying the risk.
3. Reduce risky rendering surface for high-risk users — For admins, finance, execs, and research users, consider temporary Chrome policy controls such as disabling hardware acceleration or restricting WebGL where business impact is acceptable. Use it as a *targeted* risk-reduction step within 30 days, not a fleet-wide permanent answer.
4. Watch for browser exploit after-effects — Hunt for unusual Chrome child processes, injection into browser-related processes, sudden GPU-process crash spikes, and browser-launched credential theft behavior. Stand this monitoring up within 30 days because exploit prevention coverage is weaker than post-exploit detection.

Run this on the target endpoint or via your software inventory/remote execution tool. Invoke it with python3 chrome_cve_2026_11061_check.py or python chrome_cve_2026_11061_check.py --version 149.0.7827.52; no admin rights are required unless your EDR blocks process discovery.

#!/usr/bin/env python3
# CVE-2026-11061 Chrome version check
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN / unable to determine

import argparse
import os
import platform
import re
import shutil
import subprocess
import sys
from pathlib import Path

FIXED = (149, 0, 7827, 53)


def parse_version(text):
    if not text:
        return None
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def cmp_version(a, b):
    return (a > b) - (a < b)


def run_cmd(cmd):
    try:
        p = subprocess.run(cmd, capture_output=True, text=True, timeout=10)
        out = (p.stdout or '') + '\n' + (p.stderr or '')
        return out.strip()
    except Exception:
        return ''


def detect_linux():
    candidates = [
        'google-chrome', 'google-chrome-stable', 'chromium', 'chromium-browser'
    ]
    for bin_name in candidates:
        path = shutil.which(bin_name)
        if path:
            out = run_cmd([path, '--version'])
            ver = parse_version(out)
            if ver:
                return ver, f'{bin_name} ({path})'
    return None, None


def detect_macos():
    apps = [
        '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
        str(Path.home() / 'Applications/Google Chrome.app/Contents/MacOS/Google Chrome'),
        '/Applications/Chromium.app/Contents/MacOS/Chromium'
    ]
    for app in apps:
        if os.path.exists(app):
            out = run_cmd([app, '--version'])
            ver = parse_version(out)
            if ver:
                return ver, app
    return None, None


def detect_windows():
    paths = [
        Path(os.environ.get('PROGRAMFILES', '')) / 'Google/Chrome/Application/chrome.exe',
        Path(os.environ.get('PROGRAMFILES(X86)', '')) / 'Google/Chrome/Application/chrome.exe',
        Path(os.environ.get('LOCALAPPDATA', '')) / 'Google/Chrome/Application/chrome.exe',
        Path(os.environ.get('PROGRAMFILES', '')) / 'Chromium/Application/chrome.exe',
        Path(os.environ.get('LOCALAPPDATA', '')) / 'Chromium/Application/chrome.exe',
    ]
    for p in paths:
        if p and p.exists():
            out = run_cmd([str(p), '--version'])
            ver = parse_version(out)
            if ver:
                return ver, str(p)
    return None, None


def main():
    parser = argparse.ArgumentParser(description='Check Chrome exposure to CVE-2026-11061')
    parser.add_argument('--version', help='Optional explicit version string, e.g. 149.0.7827.52')
    args = parser.parse_args()

    if args.version:
        ver = parse_version(args.version)
        source = 'user-supplied --version'
    else:
        system = platform.system().lower()
        ver = None
        source = None
        if 'linux' in system:
            ver, source = detect_linux()
        elif 'darwin' in system:
            ver, source = detect_macos()
        elif 'windows' in system:
            ver, source = detect_windows()

    if not ver:
        print('UNKNOWN - could not determine Chrome/Chromium version')
        sys.exit(2)

    print(f'Detected version: {".".join(map(str, ver))} via {source}')
    print(f'Fixed version floor: {".".join(map(str, FIXED))}')

    if cmp_version(ver, FIXED) >= 0:
        print('PATCHED')
        sys.exit(0)
    else:
        print('VULNERABLE')
        sys.exit(1)


if __name__ == '__main__':
    main()

Sources

1. Chrome Releases - Early Stable Update for Desktop (149.0.7827.53/.54)
2. Canadian Centre for Cyber Security advisory AV26-544
3. CISA Known Exploited Vulnerabilities Catalog
4. FIRST EPSS overview
5. FIRST EPSS API query syntax
6. SecurityWeek summary of Chrome 149 fixes
7. VulDB Chrome June 2026 CVE listing including CVE-2026-11061
8. Quanteta CVE tracker entry set for June 2026 Chrome CVEs