Insufficient validation of untrusted input in Codecs in Google Chrome prior to 149

CVE-2026-11079 is an input-validation flaw in Chrome's Codecs component affecting Google Chrome versions before 149.0.7827.53 on Linux and before 149.0.7827.53/54 on Windows and macOS. The attack path is straightforward at the browser layer: deliver crafted media through a web page, ad, or downloaded file, get the user to render it, and trigger faulty parsing in the codec stack. The public release note does not describe direct system-level RCE, and the user-supplied title is truncated, so the most defensible read is browser-process memory-safety impact rather than guaranteed host takeover.

The vendor-style 8.8/HIGH framing overstates what defenders should prioritize for enterprise patching. In the real world this is client-side, user-interaction-required, not internet-service-exposed, shows no KEV listing, and carries an extremely low EPSS; on top of that, Chromium's sandbox means a browser parser bug often needs a second vulnerability to become a machine-compromise event. That combination pushes this down from emergency patch queue material into normal-but-not-ignored browser hygiene.

Why this verdict

• Start at 8.8, then cut for UI requirement: UI:R means the attacker still needs the user to render malicious media. That is a real filter in managed fleets and not just CVSS bookkeeping.
• Cut again for attacker position: this is remote delivery to a browser client, not unauthenticated reachability to an enterprise service. It does not imply pre-auth compromise of a server or edge device.
• Cut for exposure population: Chrome is ubiquitous, but vulnerable instances are not internet-enumerable in the way Shodan/Censys populations are. That keeps mass opportunistic exploitation less attractive than exposed edge software.
• Cut for chain requirement: Chromium's sandbox architecture means a codec parser bug often yields browser-process impact first, with host compromise needing an additional escape or second bug.
• Cut for threat intel: EPSS is very low, no KEV listing is present, and no public PoC/weaponized tooling was found. Attackers have many cheaper edge targets.

Why not higher?

If this were an unauthenticated server-side parser bug or if there were active exploitation evidence, this would climb fast. But the real-world chain here starts with a user visit and likely stops at browser-process impact unless the attacker has another reliable bug to chain.

Why not lower?

Browsers are everywhere, and malicious media delivery through normal web browsing is easy. Even without exploit evidence, a codec flaw in a heavily used client application is still worth fixing because the reachable population is huge and drive-by delivery is practical.

1. Enforce Chrome auto-update — Make sure enterprise policy does not defer or block Stable updates, because this class of browser bug is best neutralized by shrinking version lag. For a MEDIUM noisgate verdict there is no mitigation SLA; use this as normal browser-baseline hygiene while you drive remediation inside the 365-day window.
2. Block unmanaged browser builds — Use EDR, MDM, or software inventory policy to detect and remove stale standalone Chrome installs that sit outside your normal updater path. Again, there is no mitigation SLA for MEDIUM; do this during routine compliance cleanup rather than incident footing.
3. Reduce risky content paths — Keep Safe Browsing, web filtering, ad/tracker blocking, and mail-link protections enabled to lower first-touch delivery of malicious media. These controls reduce exposure now, but they are support controls, not substitutes for the fixed browser version.
4. Watch for browser crash clusters — Aggregate chrome crash telemetry and sudden spikes in browser faults on vulnerable builds; parser-bug exploitation often looks like instability before it looks like confirmed compromise. No mitigation SLA applies here either, so fold this into ongoing endpoint telemetry review.

Run this on the target endpoint or through your endpoint management agent. Invoke it with python3 check_chrome_cve_2026_11079.py or python check_chrome_cve_2026_11079.py --path "C:\Program Files\Google\Chrome\Application\chrome.exe"; no admin rights are normally required unless your EDR blocks process version queries.

#!/usr/bin/env python3
# check_chrome_cve_2026_11079.py
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN

import os
import platform
import re
import shutil
import subprocess
import sys

THRESHOLD = (149, 0, 7827, 53)


def parse_ver(text):
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text or '')
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def cmp_ver(a, b):
    return (a > b) - (a < b)


def get_version_from_exec(path):
    try:
        out = subprocess.check_output([path, '--version'], stderr=subprocess.STDOUT, text=True, timeout=5)
        return parse_ver(out)
    except Exception:
        return None


def candidate_paths():
    paths = []
    system = platform.system().lower()

    if system == 'windows':
        envs = [
            os.environ.get('ProgramFiles'),
            os.environ.get('ProgramFiles(x86)'),
            os.environ.get('LocalAppData')
        ]
        suffixes = [
            r'Google\Chrome\Application\chrome.exe'
        ]
        for base in envs:
            if base:
                for suffix in suffixes:
                    paths.append(os.path.join(base, suffix))
    elif system == 'darwin':
        paths.extend([
            '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
            os.path.expanduser('~/Applications/Google Chrome.app/Contents/MacOS/Google Chrome')
        ])
    else:
        for name in ['google-chrome', 'google-chrome-stable', 'chrome']:
            found = shutil.which(name)
            if found:
                paths.append(found)
        paths.extend([
            '/opt/google/chrome/chrome',
            '/usr/bin/google-chrome',
            '/usr/bin/google-chrome-stable'
        ])

    deduped = []
    seen = set()
    for p in paths:
        if p and p not in seen:
            seen.add(p)
            deduped.append(p)
    return deduped


def main():
    arg_path = None
    if len(sys.argv) >= 3 and sys.argv[1] == '--path':
        arg_path = sys.argv[2]

    paths = [arg_path] if arg_path else candidate_paths()

    found_any = False
    for path in paths:
        if not path or not os.path.exists(path):
            continue
        found_any = True
        ver = get_version_from_exec(path)
        if ver is None:
            continue

        version_str = '.'.join(map(str, ver))
        if cmp_ver(ver, THRESHOLD) >= 0:
            print(f'PATCHED: {path} -> {version_str}')
            sys.exit(0)
        else:
            print(f'VULNERABLE: {path} -> {version_str} < 149.0.7827.53')
            sys.exit(1)

    if found_any:
        print('UNKNOWN: Chrome executable found but version could not be determined')
    else:
        print('UNKNOWN: Google Chrome not found in standard locations')
    sys.exit(2)


if __name__ == '__main__':
    main()

Sources

1. Chrome Releases: Stable Channel Update for Desktop
2. Canadian Centre for Cyber Security AV26-544
3. CISA Known Exploited Vulnerabilities Catalog
4. FIRST EPSS API for CVE-2026-11079
5. FIRST EPSS data reference
6. Chromium Security
7. Chromium severity guidelines
8. Censys ASM CVE Risks FAQ