Out of bounds read in V8 in Google Chrome prior to 149

CVE-2026-11075 is an out-of-bounds read in Chrome's V8 JavaScript engine. In practice, that means a malicious page can try to coerce the browser into reading memory it should not, potentially disclosing sensitive data from the affected browser process. Based on the vendor advisory trail, affected builds are Chrome prior to 149.0.7827.53 on Linux and prior to 149.0.7827.53/.54 on Windows and macOS, with disclosure on 2026-06-04 and rollout beginning in late May/early June 2026.

Google's MEDIUM 6.5 label is technically defensible in CVSS terms, but it overstates operational urgency for enterprise patch queues. This is *remote* but still requires user interaction, delivers *confidentiality-only* impact, and remains boxed inside modern browser protections unless paired with another bug; with no KEV listing, no exploitation evidence in reviewed sources, and a very low EPSS, this belongs in routine browser hygiene rather than emergency change windows.

Why this verdict

• Requires user interaction — the attacker still has to get the victim to open hostile content, which immediately narrows reachable population versus a wormable or service-side flaw.
• Confidentiality-only impact — there is no integrity or availability loss in the disclosed baseline, and no direct host compromise without chaining.
• Browser isolation cuts blast radius — Site Isolation, renderer sandboxing, and process separation mean the bug is not a straight line to domain compromise even if triggered.
• No public exploitation signal — no KEV entry, no reviewed exploitation reports, and a very low 0.00035 EPSS all push this down.
• Version inventory beats perimeter exposure — this is not externally enumerable like a VPN or edge appliance, so the reachable attack surface is governed by user behavior and update lag, not internet exposure.

Why not higher?

A higher rating would require one of three amplifiers: active exploitation, an accompanying sandbox escape/RCE path, or evidence that the info leak reliably exposes high-value secrets across normal enterprise browsing. None of those are present in the reviewed evidence. On its own, an out-of-bounds read in a modern browser is usually a *chain component* or scoped data leak, not a stand-alone crisis.

Why not lower?

It is still remotely deliverable through ordinary web content and Chrome is massively deployed, so the affected population is inherently large. Also, memory disclosure in V8 can become strategically useful when paired with another browser bug, so writing it off as pure noise would be too optimistic.

1. Enforce browser auto-update — Make sure managed Chrome channels are actually reaching 149.0.7827.53/54 or later and that stalled endpoints are flagged. For a LOW verdict there is no SLA (treat as backlog hygiene), so do this in your normal browser-maintenance motion rather than an emergency change.
2. Reduce risky web delivery — Tighten phishing-resistant web controls: Safe Browsing policy, malicious-site filtering, and ad/malvertising blocking where your enterprise stack supports it. This directly attacks the required user-navigation step; for LOW, treat it as routine posture work with no SLA (backlog hygiene).
3. Inventory vulnerable builds — Pull endpoint version telemetry from your browser-management platform, EDR, or software inventory and isolate systems stuck below the fixed builds. Because this is LOW, there is no mitigation SLA to race against; use your next normal reporting cycle.
4. Watch browser crash spikes — Feed Chrome crash telemetry and abnormal renderer fault rates into detection review, especially if tied to suspicious referrers or newly seen domains. This will not reliably detect exploitation, but it is one of the few practical tripwires for browser memory bugs; schedule it as backlog hygiene for a LOW finding.

Run this on the target Windows endpoint or through your EDR/live-response shell. Invoke it with powershell -ExecutionPolicy Bypass -File .\check-chrome-cve-2026-11075.ps1; standard user rights are usually enough because it only reads file metadata from common Chrome install paths.

# check-chrome-cve-2026-11075.ps1

# Purpose: Determine whether Google Chrome on a Windows host is vulnerable to CVE-2026-11075

# Logic: Any Chrome version lower than 149.0.7827.53 is considered VULNERABLE

# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN


$ErrorActionPreference = 'SilentlyContinue'

function Get-ChromeCandidates {
    $paths = @(
        "$Env:ProgramFiles\Google\Chrome\Application\chrome.exe",
        "$Env:ProgramFiles(x86)\Google\Chrome\Application\chrome.exe",
        "$Env:LocalAppData\Google\Chrome\Application\chrome.exe"
    )

    $existing = @()
    foreach ($p in $paths) {
        if ($p -and (Test-Path $p)) {
            $existing += $p
        }
    }
    return $existing
}

function Get-FileVersionString($path) {
    try {
        return (Get-Item $path).VersionInfo.FileVersion
    }
    catch {
        return $null
    }
}

function Normalize-Version([string]$v) {
    if (-not $v) { return $null }
    $clean = ($v -split '\s+')[0].Trim()
    try {
        return [version]$clean
    }
    catch {
        return $null
    }
}

$fixedVersion = [version]'149.0.7827.53'
$candidates = Get-ChromeCandidates

if (-not $candidates -or $candidates.Count -eq 0) {
    Write-Output 'UNKNOWN - Google Chrome executable not found in common install paths.'
    exit 2
}

$results = @()
foreach ($chromePath in $candidates) {
    $raw = Get-FileVersionString -path $chromePath
    $ver = Normalize-Version -v $raw

    if ($ver -eq $null) {
        $results += [pscustomobject]@{
            Path = $chromePath
            RawVersion = $raw
            ParsedVersion = $null
            Status = 'UNKNOWN'
        }
        continue
    }

    $status = if ($ver -lt $fixedVersion) { 'VULNERABLE' } else { 'PATCHED' }
    $results += [pscustomobject]@{
        Path = $chromePath
        RawVersion = $raw
        ParsedVersion = $ver.ToString()
        Status = $status
    }
}

$results | ForEach-Object {
    Write-Output ("{0} - {1} - {2}" -f $_.Status, $_.ParsedVersion, $_.Path)
}

if ($results.Status -contains 'VULNERABLE') {
    exit 1
}
elseif ($results.Status -contains 'PATCHED') {
    exit 0
}
else {
    Write-Output 'UNKNOWN - Unable to parse any Chrome version.'
    exit 2
}

Sources

1. Chrome Releases - Early Stable Update for Desktop
2. Canadian Centre for Cyber Security AV26-544
3. CISA Known Exploited Vulnerabilities Catalog
4. FIRST EPSS project
5. FIRST EPSS API
6. Quanteta CVE tracker entry set including CVE-2026-11075
7. Chrome for Testing availability index