Inappropriate implementation in Canvas in Google Chrome prior to 149

CVE-2026-11081 is a Chrome Canvas implementation flaw that lets a remote attacker use a crafted HTML page to bypass part of the browser's same-origin policy. Affected builds are Google Chrome prior to 149.0.7827.53 on Linux and the corresponding 149.0.7827.53/54 stable desktop train called out by Google on 2026-06-02; in practice this means managed endpoints still running pre-149 stable are exposed.

Google tagged it *Medium* and that is already a little generous for enterprise patch triage. The bug matters because Chrome is everywhere, but the real attack chain still depends on user interaction, a live browser session, and a web-origin integrity impact rather than code execution or device compromise; with no KEV listing, no public PoC in primary sources, and a very low EPSS, this is better treated as backlog hygiene than an interrupt-the-week emergency.

Why this verdict

• User interaction required: the UI:R prerequisite means this is not wormable, not drive-by on closed fleets, and not directly reachable like a server bug.
• Session-scoped impact: the published impact is I:H with C:N/A:N, which points to browser trust abuse inside a web session rather than host takeover or broad data loss.
• No current threat signal: no KEV listing, no public PoC in primary sources reviewed, and a user-supplied EPSS of 0.00016 all push downward from the vendor baseline.
• Exposure is broad but shallow: Chrome is everywhere, which keeps this from being IGNORE, but automatic updates and endpoint management usually collapse the vulnerable window fast.
• Post-initial-app-context dependency: the attacker still needs a victim to be browsing and, for meaningful business impact, to be authenticated into a target application that lacks stronger app-layer controls.

Why not higher?

This is not unauthenticated server-side RCE, not sandbox escape, and not a host-compromise primitive. The chain requires a human to browse attacker content and then still depends on a second context—an active, valuable web session—to produce real business impact.

Why not lower?

A same-origin-policy bypass in Chrome is still a browser trust-boundary failure in one of the most deployed applications in the enterprise. Even without code execution, a workable cross-origin integrity primitive can be abused against SaaS workflows and admin consoles, so it deserves tracking and version enforcement rather than dismissal.

1. Enforce auto-update policy — Make sure Chrome stable updates are not deferred or pinned below 149.0.7827.53/54. For a LOW verdict there is no SLA-backed mitigation deadline, but this is the cleanest way to shrink exposure without relying on user behavior.
2. Tighten browser access controls — Use secure web gateway filtering, DNS filtering, and category-based blocking to cut off newly registered domains, ad-tech abuse, and other common lure paths. For LOW, treat this as backlog hardening rather than an emergency control.
3. Harden high-risk web apps — Prioritize CSRF protection, same-site cookie settings, transaction confirmation, and step-up MFA on finance, admin, and identity workflows. Those controls reduce the payoff of a browser-origin integrity break even if a user lands on a malicious page.
4. Watch for vulnerable stragglers — Query endpoint telemetry for Chrome versions below 149.0.7827.53 and focus on unmanaged laptops, VDI gold images, kiosk systems, and exception-based update rings. These are the places browser-version drift survives longest.

Run this on the target endpoint or through your fleet automation tooling. Invoke it as python3 check_cve_2026_11081.py on Linux/macOS or py check_cve_2026_11081.py on Windows; standard user rights are usually enough because it only reads local application metadata and common install paths.

#!/usr/bin/env python3
# check_cve_2026_11081.py
# Determine whether local Chrome/Chromium installs are below the fixed version for CVE-2026-11081.
# Outputs exactly one of: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import subprocess
import sys
from pathlib import Path

FIXED = (149, 0, 7827, 53)
VERSION_RE = re.compile(r"(\d+)\.(\d+)\.(\d+)\.(\d+)")


def parse_version(text):
    if not text:
        return None
    m = VERSION_RE.search(text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def cmp_version(a, b):
    return (a > b) - (a < b)


def run_cmd(cmd):
    try:
        p = subprocess.run(cmd, capture_output=True, text=True, timeout=10)
        out = (p.stdout or "") + "\n" + (p.stderr or "")
        return parse_version(out)
    except Exception:
        return None


def windows_candidates():
    roots = [
        os.environ.get("ProgramFiles", r"C:\Program Files"),
        os.environ.get("ProgramFiles(x86)", r"C:\Program Files (x86)"),
        os.environ.get("LocalAppData", ""),
    ]
    rels = [
        r"Google\Chrome\Application\chrome.exe",
        r"Chromium\Application\chrome.exe",
    ]
    paths = []
    for root in roots:
        if root:
            for rel in rels:
                paths.append(str(Path(root) / rel))
    return paths


def mac_candidates():
    return [
        "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome",
        "/Applications/Chromium.app/Contents/MacOS/Chromium",
    ]


def linux_commands():
    return [
        ["google-chrome", "--version"],
        ["google-chrome-stable", "--version"],
        ["chromium-browser", "--version"],
        ["chromium", "--version"],
    ]


def collect_versions():
    found = []
    system = platform.system().lower()

    if "windows" in system:
        for exe in windows_candidates():
            if os.path.exists(exe):
                v = run_cmd([exe, "--version"])
                if v:
                    found.append((exe, v))
    elif "darwin" in system:
        for exe in mac_candidates():
            if os.path.exists(exe):
                v = run_cmd([exe, "--version"])
                if v:
                    found.append((exe, v))
    else:
        for cmd in linux_commands():
            v = run_cmd(cmd)
            if v:
                found.append((cmd[0], v))

    return found


def main():
    found = collect_versions()
    if not found:
        print("UNKNOWN")
        sys.exit(2)

    vulnerable = []
    patched = []
    for name, version in found:
        if cmp_version(version, FIXED) < 0:
            vulnerable.append((name, version))
        else:
            patched.append((name, version))

    if vulnerable:
        print("VULNERABLE")
        sys.exit(1)

    if patched:
        print("PATCHED")
        sys.exit(0)

    print("UNKNOWN")
    sys.exit(2)


if __name__ == "__main__":
    main()

Sources

1. NVD CVE-2026-11081
2. Chrome Releases - Stable Channel Update for Desktop
3. Chromium issue 500076131
4. CISA Known Exploited Vulnerabilities Catalog
5. FIRST EPSS overview
6. FIRST EPSS API documentation
7. MITRE CWE-346 Origin Validation Error
8. Chromium Security