Insufficient validation of untrusted input in Cast in Google Chrome prior to 149

The supplied record describes a Cast input-validation flaw in Chrome that lets a remote attacker bypass same-origin protections using a crafted HTML page, affecting versions before 149.0.7827.53 on Linux and 149.0.7827.53/54 on Windows/macOS. One important caveat: as of 2026-06-05, the public Chrome 149 release notes do list CVE-2026-11069 as a Medium Cast validation bug, but the fuller public description matching your title currently aligns with the analogous public record CVE-2026-11259; this assessment follows the *behavior* you supplied, not the ID string blindly.

paragraphs continued: same-origin bypass sounds scary in abstract, but the real path is much narrower than a server-side internet-edge flaw. The attacker still needs the victim to load malicious content, the bug lives in a Cast-specific code path rather than a universally exposed network service, Chrome’s modern site isolation architecture reduces blast radius, and there is no KEV listing or credible public exploitation signal. That makes the vendor's MEDIUM 6.5 feel too generous for enterprise patch prioritization.

Why this verdict

• User-click required: UI:R means the attacker still needs delivery and victim interaction before anything happens.
• Feature-path narrowing: this sits in Cast, not a universally reachable server or generic memory-corruption path; that sharply cuts reachable population in real enterprise use.
• No exploitation signal: no KEV listing, no public PoC, and a tiny supplied EPSS materially reduce immediate operational risk.
• Blast radius is browser-bounded: even if same-origin checks are bypassed, this is still not equivalent to native code execution or unauthenticated server compromise.
• Vendor baseline looks inflated: the analogous public NVD/CISA-ADP record for the same behavior is lower (4.3) than the supplied 6.5, which reinforces a downgrade.

Why not higher?

This is not an unauthenticated server-side bug, not a memory-corruption-to-RCE issue, and not something an external scanner can find on your perimeter. The exploit chain starts with social or web delivery and then depends on a specific browser feature path, which is exactly the kind of compound friction that pushes enterprise urgency down.

Why not lower?

A same-origin bypass is still a real security-boundary failure inside the browser, and Chrome is widely deployed across enterprise fleets. If an attacker can reliably trigger it against authenticated users, it can enable cross-origin actions or content tampering that defenders should not ignore.

1. Force auto-update compliance — Ensure Chrome stable-channel updates are actually landing on endpoints and unmanaged browsers are blocked from corp access. For a LOW noisgate verdict there is no SLA, so treat this as backlog hygiene while still cleaning up stale versions through normal browser management.
2. Reduce malicious-page delivery — Tighten email URL filtering, web isolation, Safe Browsing enforcement, and high-risk user browser controls to cut off the only realistic initial step: getting a victim onto attacker HTML. For a LOW verdict there is no mitigation SLA; fold this into routine hardening rather than emergency change windows.
3. Enforce browser inventory visibility — Use EDR, software inventory, MDM, or enterprise browser management to identify hosts below 149.0.7827.53/54. Because this is endpoint software rather than a network service, inventory accuracy matters more than perimeter scanning.
4. Prefer site isolation defaults — Keep Chrome’s Site Isolation protections enabled and do not weaken them through performance-driven exceptions. They do not remove the bug, but they reduce the practical value of same-origin boundary mistakes.

Run this on the target endpoint or through your EDR/remote execution tool, not from an auditor workstation. Invoke it with python3 check_chrome_149.py (Windows can use py check_chrome_149.py); no admin rights are strictly required, but local read access to standard install paths is needed.

#!/usr/bin/env python3
# check_chrome_149.py
# Exit codes:
# 0 = PATCHED
# 1 = VULNERABLE
# 2 = UNKNOWN

import os
import platform
import re
import subprocess
import sys
from pathlib import Path

FIX_MIN = (149, 0, 7827, 53)

CANDIDATES = {
    'Windows': [
        Path(os.environ.get('ProgramFiles', r'C:\Program Files')) / 'Google/Chrome/Application/chrome.exe',
        Path(os.environ.get('ProgramFiles(x86)', r'C:\Program Files (x86)')) / 'Google/Chrome/Application/chrome.exe',
        Path(os.environ.get('LocalAppData', '')) / 'Google/Chrome/Application/chrome.exe',
    ],
    'Darwin': [
        Path('/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'),
        Path.home() / 'Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
    ],
    'Linux': [
        Path('/usr/bin/google-chrome'),
        Path('/usr/bin/google-chrome-stable'),
        Path('/opt/google/chrome/chrome'),
        Path('/snap/bin/chromium'),
        Path('/usr/bin/chromium'),
        Path('/usr/bin/chromium-browser'),
    ],
}


def parse_version(s):
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', s)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def version_to_str(v):
    return '.'.join(str(x) for x in v)


def run_version(binary):
    try:
        out = subprocess.check_output([str(binary), '--version'], stderr=subprocess.STDOUT, timeout=8)
        return out.decode(errors='ignore').strip()
    except Exception:
        return None


def find_installed():
    system = platform.system()
    keys = {'Windows': 'Windows', 'Darwin': 'Darwin'}.get(system, 'Linux')
    found = []
    for p in CANDIDATES.get(keys, []):
        if p and p.exists():
            found.append(p)
    return found


def main():
    found = find_installed()
    if not found:
        print('UNKNOWN - Chrome/Chromium binary not found in standard locations')
        sys.exit(2)

    best = None
    best_path = None
    for binary in found:
        raw = run_version(binary)
        if not raw:
            continue
        ver = parse_version(raw)
        if ver and (best is None or ver > best):
            best = ver
            best_path = binary

    if best is None:
        print('UNKNOWN - Unable to read browser version from discovered binaries')
        sys.exit(2)

    if best < FIX_MIN:
        print(f'VULNERABLE - Found {version_to_str(best)} at {best_path}; expected >= {version_to_str(FIX_MIN)}')
        sys.exit(1)
    else:
        print(f'PATCHED - Found {version_to_str(best)} at {best_path}; meets >= {version_to_str(FIX_MIN)}')
        sys.exit(0)


if __name__ == '__main__':
    main()

Sources

1. Chrome Releases - Stable Channel Update for Desktop (Chrome 149)
2. Chrome Releases - Early Stable Update for Desktop
3. NVD - CVE-2026-11259
4. Chromium issue referenced by NVD for analogous public description
5. CISA Known Exploited Vulnerabilities Catalog
6. FIRST EPSS API documentation
7. Chrome 149 release notes
8. Chromium Site Isolation overview