Insufficient validation of untrusted input in Chromoting in Google Chrome on Windows prior to 149

CVE-2026-11070 is an *insufficient validation of untrusted input* flaw in Chrome's Chromoting component on Windows. Public advisories place affected builds before the Chrome 149 desktop release, with Windows fixed in the 149.0.7827.53/.54 train; for enterprise validation, 149.0.7827.53 is the safe floor and anything older should be treated as exposed.

The big story is the severity mismatch: the prompt carries a CRITICAL 9.6 label, but Google's own June 2, 2026 Chrome stable advisory lists CVE-2026-11070 as Medium, not Critical. That matters. With no KEV entry, no public exploit evidence, no public PoC, Windows-only scope, and user interaction implied by the broader browser exploitation model, this looks like a *chain component or hardening issue* rather than a one-click fleet-wide catastrophe.

Why this verdict

• Vendor baseline correction: Google's own Chrome stable advisory on 2026-06-02 lists CVE-2026-11070 as Medium, so the prompt's Critical 9.6 enrichment is not a trustworthy vendor baseline.
• User-driven client exploit path: attacker success starts with a Windows user opening crafted content, which is meaningfully narrower than an unauthenticated remote service bug.
• No exploitation heat: no KEV, no public PoC, and no observed campaign reporting means there is no current evidence this bug is being operationalized at scale.
• Windows-only narrowing: this is not a whole-Chrome-all-platforms event; it trims the reachable population in mixed estates.
• Likely chain component, not stand-alone takeover: the combination of insufficient validation, sparse public detail, and Google's Medium bucket implies downward pressure because practical impact probably depends on additional conditions or a second bug.

Why not higher?

I am not scoring this HIGH or CRITICAL because the public evidence does not support an active, reliable, one-step browser-to-host compromise story. If this were a proven in-the-wild Chrome RCE/sandbox-escape primitive, it would almost certainly show up with a stronger vendor bucket, KEV traction, or public exploit attention very quickly.

Why not lower?

I am not dropping this to LOW or IGNORE because Chrome on Windows is massively deployed and the vulnerable surface is attacker-reachable through ordinary browsing. Even a medium-grade browser bug deserves cleanup through managed browser updates, especially on high-risk user populations.

1. Force Chrome auto-update health — Validate Google Update, WSUS-equivalent packaging, or your browser management tooling so Windows endpoints converge to 149.0.7827.53+. For a MEDIUM finding there is no mitigation SLA, so use the next normal browser maintenance cycle rather than emergency change control.
2. Tighten risky browsing paths — Apply or verify web filtering, Safe Browsing enforcement, and attachment detonation for users most likely to hit opportunistic exploit delivery. This is a sensible exposure reducer while patch rollout completes, but for MEDIUM there is no noisgate mitigation SLA — go straight to the remediation window.
3. Watch Chrome crash telemetry — Hunt for chrome.exe crashes, abnormal child processes, or repeated browser faulting on Windows endpoints to catch exploit development or unstable triggering. Use this as detection enrichment during the normal remediation cycle.
4. Prioritize admin and privileged workstations — Patch jump hosts, admin laptops, help-desk endpoints, and developer workstations first because browser compromise on privileged users carries outsized blast radius. Even without a mitigation SLA, front-loading high-value users is the right operational move.

Run this on the target Windows host from an elevated PowerShell prompt so it can inspect machine-wide and per-user Chrome installs. Example: powershell -ExecutionPolicy Bypass -File .\check-chrome-cve-2026-11070.ps1; it needs local admin to enumerate all user profile installs reliably.

# check-chrome-cve-2026-11070.ps1

# Purpose: Determine whether a Windows host is vulnerable to CVE-2026-11070 based on installed Chrome version.

# Output: VULNERABLE / PATCHED / UNKNOWN

# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN, 3=ERROR


$ErrorActionPreference = 'Stop'
$MinimumSafeVersion = [version]'149.0.7827.53'

function Compare-Version {
    param(
        [Parameter(Mandatory=$true)][string]$VersionString,
        [Parameter(Mandatory=$true)][version]$MinimumVersion
    )
    try {
        $v = [version]$VersionString
        return ($v -ge $MinimumVersion)
    } catch {
        return $null
    }
}

function Get-ChromeCandidates {
    $paths = New-Object System.Collections.Generic.List[string]

    $machinePaths = @(
        "$env:ProgramFiles\Google\Chrome\Application\chrome.exe",
        "${env:ProgramFiles(x86)}\Google\Chrome\Application\chrome.exe"
    )

    foreach ($p in $machinePaths) {
        if ($p -and (Test-Path $p)) { [void]$paths.Add($p) }
    }

    $userRoot = 'C:\Users'
    if (Test-Path $userRoot) {
        Get-ChildItem -Path $userRoot -Directory -ErrorAction SilentlyContinue | ForEach-Object {
            $userChrome = Join-Path $_.FullName 'AppData\Local\Google\Chrome\Application\chrome.exe'
            if (Test-Path $userChrome) { [void]$paths.Add($userChrome) }
        }
    }

    return $paths | Sort-Object -Unique
}

try {
    $candidates = Get-ChromeCandidates

    if (-not $candidates -or $candidates.Count -eq 0) {
        Write-Output 'UNKNOWN: Google Chrome not found in standard machine-wide or per-user paths.'
        exit 2
    }

    $results = @()
    foreach ($path in $candidates) {
        try {
            $item = Get-Item $path
            $versionString = $item.VersionInfo.ProductVersion
            if (-not $versionString) { $versionString = $item.VersionInfo.FileVersion }

            $isSafe = Compare-Version -VersionString $versionString -MinimumVersion $MinimumSafeVersion

            $results += [pscustomobject]@{
                Path       = $path
                Version    = $versionString
                IsPatched  = $isSafe
            }
        } catch {
            $results += [pscustomobject]@{
                Path       = $path
                Version    = 'UNKNOWN'
                IsPatched  = $null
            }
        }
    }

    $vuln = $results | Where-Object { $_.IsPatched -eq $false }
    $unknown = $results | Where-Object { $_.IsPatched -eq $null }

    if ($vuln.Count -gt 0) {
        Write-Output 'VULNERABLE'
        $results | ForEach-Object {
            Write-Output ("{0} :: Version={1} :: Patched={2}" -f $_.Path, $_.Version, $_.IsPatched)
        }
        exit 1
    }

    if ($unknown.Count -gt 0 -and ($results | Where-Object { $_.IsPatched -eq $true }).Count -eq 0) {
        Write-Output 'UNKNOWN'
        $results | ForEach-Object {
            Write-Output ("{0} :: Version={1} :: Patched={2}" -f $_.Path, $_.Version, $_.IsPatched)
        }
        exit 2
    }

    Write-Output 'PATCHED'
    $results | ForEach-Object {
        Write-Output ("{0} :: Version={1} :: Patched={2}" -f $_.Path, $_.Version, $_.IsPatched)
    }
    exit 0

} catch {
    Write-Output ('UNKNOWN: error while checking Chrome version - ' + $_.Exception.Message)
    exit 3
}

Sources

1. Google Chrome Releases - Stable Channel Update for Desktop (June 2, 2026)
2. Canadian Centre for Cyber Security - Google Chrome security advisory AV26-544
3. GovCERT.HK - Multiple Vulnerabilities in Google Chrome
4. CISA Known Exploited Vulnerabilities Catalog
5. FIRST - EPSS overview
6. FIRST - EPSS API documentation
7. Chrome Enterprise - Manage Chrome updates (Windows)
8. Chromium issue reference for CVE-2026-11070