Race in GPU in Google Chrome on Android prior to 149

As of 2026-06-06, I could not verify an official published record for CVE-2026-11064. The metadata you supplied lines up much more closely with CVE-2026-11123: an Android Chrome bug fixed before 149.0.7827.53, classified as CWE-457, where uninitialized use in ANGLE/GPU can leak sensitive process memory through crafted HTML. In plain English: after an attacker already gets code running in the browser renderer, this bug may let them read leftover data they should not see.

Google's MEDIUM label is defensible in generic browser-land, but for enterprise patch triage it is still too generous. The decisive friction is the prerequisite: the attacker must already have compromised the renderer process. That makes this a second-stage exploit-chain primitive with narrow real-world reach, Android-only scope, no KEV listing, and no reliable public weaponization I could verify.

Why this verdict

• Renderer compromise required: this is not initial access. Requiring a separate first-stage browser exploit is a major downward adjustment from the supplied 6.5 baseline.
• Android-only exposure: even if Chrome is common, this record is narrowed to Android builds below 149.0.7827.53, not your whole desktop browser estate.
• Disclosure, not takeover: the likely intended bug leaks process memory; it does not hand the attacker direct persistence, remote code execution on the device, or enterprise-wide lateral movement by itself.
• No live-fire indicators: no KEV entry, no verified in-the-wild note, and no authoritative public PoC materially reduce urgency.

Why not higher?

If this were the sibling Android GPU bug that genuinely enabled a renderer-to-sandbox escape, or if Google/CISA had confirmed exploitation, the score would jump sharply. Likewise, an issue reachable without prior renderer compromise would deserve at least MEDIUM and likely higher.

Why not lower?

It still affects a massively deployed browser family and can expose sensitive browser-resident data on mobile devices. For high-risk users who do privileged SaaS administration from Android Chrome, even a chain-dependent info leak is not something to ignore outright.

1. Force Chrome auto-update on managed Android — Use MDM/EMM controls and Play managed app policies to keep com.android.chrome current. For a LOW noisgate verdict there is no mitigation SLA; treat this as backlog hygiene, but version drift on mobile browsers should still be cleaned up in your normal maintenance cycle.
2. Keep privileged workflows off mobile browsers — Restrict break-glass admin actions, cloud-console administration, and other high-value sessions from Android Chrome where feasible. This reduces the value of any browser-memory disclosure; for LOW, there is no formal mitigation deadline, so apply this as policy hardening rather than emergency response.
3. Inventory sub-fixed Android Chrome versions — Query managed devices for Chrome versions below 149.0.7827.53 and target stale cohorts first. This is mainly to reduce long-tail exposure and confirm whether you even have a meaningful affected population.
4. Enable additional site isolation for sensitive origins where supported — Chromium documents stronger isolation options on Android for organizations that need extra protection around high-value sites. This does not patch the bug, but it can reduce same-process data co-residency and lower leak usefulness.

Run this from an auditor workstation with ADB access to the target Android device, or adapt the same package query in your MDM shell. Invoke it as ./check_chrome_android.sh com.android.chrome 149.0.7827.53; no root is required, but the device must be reachable via adb shell and permit package metadata queries.

#!/usr/bin/env bash
# check_chrome_android.sh
# Purpose: Check whether Android Chrome is below a fixed version.
# Usage: ./check_chrome_android.sh [package_name] [fixed_version]
# Example: ./check_chrome_android.sh com.android.chrome 149.0.7827.53
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

PKG="${1:-com.android.chrome}"
FIXED="${2:-149.0.7827.53}"

command -v adb >/dev/null 2>&1 || {
  echo "UNKNOWN: adb not found in PATH"
  exit 2
}

adb get-state >/dev/null 2>&1 || {
  echo "UNKNOWN: no adb device available"
  exit 2
}

raw="$(adb shell dumpsys package "$PKG" 2>/dev/null | tr -d '\r' | grep -m1 'versionName=')"
if [ -z "$raw" ]; then
  echo "UNKNOWN: package '$PKG' not found or versionName unavailable"
  exit 2
fi

INSTALLED="${raw#*=}"
INSTALLED="$(echo "$INSTALLED" | xargs)"

norm_ver() {
  local v="$1"
  local IFS='.'
  local parts
  read -r -a parts <<< "$v"
  printf '%d %d %d %d\n' "${parts[0]:-0}" "${parts[1]:-0}" "${parts[2]:-0}" "${parts[3]:-0}"
}

ver_lt() {
  local a b
  a=( $(norm_ver "$1") )
  b=( $(norm_ver "$2") )
  for i in 0 1 2 3; do
    if [ "${a[$i]}" -lt "${b[$i]}" ]; then
      return 0
    elif [ "${a[$i]}" -gt "${b[$i]}" ]; then
      return 1
    fi
  done
  return 1
}

if ver_lt "$INSTALLED" "$FIXED"; then
  echo "VULNERABLE: $PKG installed version $INSTALLED is below fixed version $FIXED"
  exit 1
else
  echo "PATCHED: $PKG installed version $INSTALLED is at or above fixed version $FIXED"
  exit 0
fi

Sources

1. Vulnerability-Lookup record for CVE-2026-11123
2. Vulnerability-Lookup record for CVE-2026-11119
3. Chrome Releases: Early Stable Update for Desktop 149.0.7827.53/.54
4. Chrome Releases homepage showing Android 149.0.7827.48 rollout
5. CISA Known Exploited Vulnerabilities catalog
6. FIRST EPSS data and daily reports
7. Chromium Site Isolation overview
8. Chromium GPU process design document