Insufficient policy enforcement in Extensions in Google Chrome prior to 149

CVE-2026-11062 is an *insufficient policy enforcement* flaw in Chrome Extensions that affects Google Chrome versions prior to 149.0.7827.53. The published description says a user must first be convinced to install a malicious Chrome extension, after which that extension can inject scripts or HTML into a privileged page. For defenders, that matters: this is not a drive-by web bug and not a no-click browser RCE; it is a trust-boundary failure that starts with extension installation.

Google's 4.3 / MEDIUM is fair in the abstract, but for managed enterprise fleets it is still a bit generous. The decisive friction is the prerequisite chain: attacker needs social engineering success, the victim must install a malicious extension, and many enterprises already constrain extensions through allowlists, force-installs, or permission-based policy. Large Chrome deployment keeps it from being *IGNORE*, but the real-world reachable population inside well-managed estates is much narrower than the vendor baseline suggests.

Why this verdict

• Downward adjustment: requires user action — UI:R is not cosmetic here; the exploit path begins only after a user installs a malicious extension.
• Downward adjustment: attacker position is pre-compromise social engineering, not unauthenticated remote code execution — this is a narrow initial-access dependency, not a general web-triggered browser bug.
• Downward adjustment: real enterprise exposure is policy-shaped — Chrome Enterprise supports allow/block and force-install controls, which means many managed fleets can prevent or heavily constrain arbitrary extension installation.
• Downward adjustment: impact is limited — the published CVSS reflects integrity-only impact with no confidentiality or availability loss in the base case.
• Downward adjustment: threat intel is cold — no KEV listing, no active exploitation evidence reviewed, and the provided EPSS is near zero.
• Upward pressure retained — Chrome is massively deployed, so even medium-friction extension abuse matters enough to keep this above *IGNORE*.

Why not higher?

To score this higher, you would want one of three amplifiers: a web-only trigger, public weaponization, or active exploitation. We have none of those here. The malicious-extension prerequisite is a hard gate that collapses the exposed population compared with ordinary browser CVEs.

Why not lower?

This is still a trusted-browser-surface issue in the most widely deployed desktop browser, so dismissing it entirely would be sloppy. Unmanaged endpoints, developer workstations, and loosely governed BYOD populations can absolutely meet the install-an-extension prerequisite, and privileged-page injection can still enable meaningful follow-on abuse.

1. Lock down extension installs — Use ExtensionSettings, allowlists, and blocklists so users cannot freely install arbitrary extensions. For a LOW noisgate verdict there is no SLA (treat as backlog hygiene), but if you lack extension governance today, add this in the next normal browser policy cycle because it cuts off the exploit path entirely.
2. Inventory installed extensions — Collect extension IDs, install sources, and permission sets from managed Chrome endpoints to identify risky or non-approved add-ons. For LOW, there is no SLA (treat as backlog hygiene); fold this into your standard endpoint and browser telemetry program.
3. Prefer force-installed approved extensions — Where the business genuinely needs extensions, use centrally approved and force-installed packages instead of user discretion. For LOW, there is no SLA (treat as backlog hygiene), but this is the cleanest structural defense against the entire class.
4. Alert on new extension installs — Create detections for first-seen extension IDs, installs outside your approved list, and sideload indicators. For LOW, there is no SLA (treat as backlog hygiene); deploy as part of normal detective-control hardening.

Run this on the target endpoint or via your software inventory runner. Invoke it with python3 chrome_cve_2026_11062_check.py on macOS/Linux or py chrome_cve_2026_11062_check.py on Windows; standard user rights are usually enough because the script only reads local Chrome version metadata and binaries.

#!/usr/bin/env python3
# CVE-2026-11062 local Chrome version check
# Outputs: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import subprocess
import sys
from pathlib import Path

FIXED = (149, 0, 7827, 53)


def parse_version(text):
    if not text:
        return None
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def cmp_version(a, b):
    return (a > b) - (a < b)


def read_file(path):
    try:
        return Path(path).read_text(encoding='utf-8', errors='ignore')
    except Exception:
        return None


def run_cmd(cmd):
    try:
        out = subprocess.check_output(cmd, stderr=subprocess.STDOUT, text=True)
        return out.strip()
    except Exception:
        return None


def get_windows_version():
    candidates = [
        os.path.expandvars(r'%ProgramFiles%\Google\Chrome\Application\chrome.exe'),
        os.path.expandvars(r'%ProgramFiles(x86)%\Google\Chrome\Application\chrome.exe'),
        os.path.expandvars(r'%LocalAppData%\Google\Chrome\Application\chrome.exe'),
    ]

    for exe in candidates:
        if exe and os.path.exists(exe):
            ps = [
                'powershell', '-NoProfile', '-Command',
                f"(Get-Item '{exe}').VersionInfo.ProductVersion"
            ]
            out = run_cmd(ps)
            ver = parse_version(out)
            if ver:
                return ver, exe
    return None, None


def get_macos_version():
    app = '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'
    if os.path.exists(app):
        out = run_cmd([app, '--version'])
        ver = parse_version(out)
        if ver:
            return ver, app

    plist = '/Applications/Google Chrome.app/Contents/Info.plist'
    if os.path.exists(plist):
        out = run_cmd(['/usr/bin/defaults', 'read', plist, 'KSVersion'])
        ver = parse_version(out)
        if ver:
            return ver, plist
    return None, None


def get_linux_version():
    candidates = [
        ['google-chrome', '--version'],
        ['google-chrome-stable', '--version'],
        ['/opt/google/chrome/chrome', '--version'],
        ['/usr/bin/google-chrome', '--version'],
        ['/usr/bin/google-chrome-stable', '--version'],
    ]
    for cmd in candidates:
        out = run_cmd(cmd)
        ver = parse_version(out)
        if ver:
            return ver, ' '.join(cmd)
    return None, None


def main():
    system = platform.system().lower()
    version = None
    source = None

    if 'windows' in system:
        version, source = get_windows_version()
    elif 'darwin' in system:
        version, source = get_macos_version()
    elif 'linux' in system:
        version, source = get_linux_version()

    if not version:
        print('UNKNOWN - Google Chrome version could not be determined on this host')
        sys.exit(2)

    if cmp_version(version, FIXED) < 0:
        print(f'VULNERABLE - Chrome version {".".join(map(str, version))} detected via {source}; fixed version is >= {".".join(map(str, FIXED))}')
        sys.exit(1)
    else:
        print(f'PATCHED - Chrome version {".".join(map(str, version))} detected via {source}; fixed version is >= {".".join(map(str, FIXED))}')
        sys.exit(0)


if __name__ == '__main__':
    main()

Sources

1. NVD CVE-2026-11062 detail
2. Chrome Releases stable channel update for desktop
3. VulDB CVE-2026-11062 summary
4. Chrome Enterprise - Managing Extensions in Your Enterprise
5. Chrome Enterprise - Configure ExtensionSettings policy
6. Chrome Enterprise - ExtensionInstallForcelist policy
7. FIRST EPSS API documentation
8. CISA Known Exploited Vulnerabilities Catalog