Inappropriate implementation in Password Manager in Google Chrome prior to 149

CVE-2026-11084 is an *inappropriate implementation* flaw in Chrome's Password Manager that affects Chrome versions prior to 149.0.7827.53 on Linux and 149.0.7827.53/.54 on Windows and macOS. Per the vendor description, a remote attacker can use crafted web content to leak cross-origin data, which means a hostile site can potentially read data that should have remained isolated to a different site or origin boundary inside the browser context.

Google tagged it *Medium* at 6.5, and that is understandable from a pure CVSS lens because it is confidentiality-only and still needs user interaction. For enterprise defenders, I would bump it to *HIGH* anyway: Chrome is everywhere, delivery is just normal browsing, and the vulnerable component is Password Manager-adjacent, which turns a 'mere data leak' into a likely credential and session exposure problem on high-value user endpoints.

Why this verdict

• Upward pressure: browser ubiquity — Chrome is a near-universal enterprise endpoint application, so a web-delivered client bug has a much larger reachable population than a niche desktop app.
• Upward pressure: sensitive data class — this is a Password Manager issue with cross-origin leakage, so the likely business impact is stolen secrets, credentials, or session-bearing data rather than harmless page data.
• Downward pressure: requires user browsing — the attacker needs the victim to render hostile content, which means phishing, malvertising, or site compromise still has to do real work first.
• Downward pressure: no auth but no code execution — this is not a straight remote code execution or sandbox escape; the blast radius is usually one user context at a time.
• Downward pressure: no KEV / no public exploit evidence — absent active exploitation or a mature PoC, this does not justify a CRITICAL label.

Why not higher?

I did not score this as CRITICAL because the attack path still needs user interaction and the public description points to data leakage, not arbitrary code execution or fleet-wide takeover. It is also not backed by KEV listing or known in-the-wild exploitation, which removes the biggest urgency multiplier.

Why not lower?

I did not leave this at MEDIUM because CVSS undersells what *Password Manager + cross-origin leak + browser ubiquity* means operationally. In a 10,000-host enterprise, a web-delivered secret-exposure bug on the dominant browser is not backlog filler.

1. Block outdated Chrome builds — Use EDR, MDM, or software inventory policy to identify and quarantine browsers older than 149.0.7827.53; for a HIGH verdict, deploy this control within 30 days if patch rollout lags. This is the cleanest temporary reduction because it targets the vulnerable population directly.
2. Force browser auto-update compliance — Verify enterprise update channels are enabled and not pinned below the fixed build; enforce policy drift correction within 30 days. Chrome moves fast, and stale channels are what turn browser vulns into long-tail exposure.
3. Harden web filtering for high-risk categories — Tighten controls on newly registered domains, ad-tech-heavy destinations, and uncategorized sites within 30 days. This does not fix the bug, but it cuts the most likely delivery paths for crafted content.
4. Prioritize privileged and SaaS-heavy users — Patch and verify admins, finance, executives, developers, and users with broad SaaS access first, within 30 days. If this bug leaks secrets, those users provide the highest-value downstream account takeover opportunities.
5. Watch for identity follow-on signals — Increase monitoring for anomalous sign-ins, token replay, and unusual SaaS actions within 30 days. This is where a browser data leak is most likely to surface if initial web telemetry misses it.

Run this on the target endpoint or through your software-distribution/EDR script runner. Invoke it as python3 check_cve_2026_11084.py on macOS/Linux or py check_cve_2026_11084.py on Windows; standard user rights are usually enough because it only reads installed Chrome version data.

#!/usr/bin/env python3
# CVE-2026-11084 Chrome version check
# Outputs one of: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import subprocess
import sys
from pathlib import Path

FIXED = (149, 0, 7827, 53)


def parse_version(text):
    if not text:
        return None
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def run_cmd(cmd):
    try:
        p = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, timeout=10)
        out = (p.stdout or '') + ' ' + (p.stderr or '')
        return out.strip()
    except Exception:
        return ''


def check_windows():
    candidates = [
        os.path.join(os.environ.get('ProgramFiles', r'C:\Program Files'), 'Google', 'Chrome', 'Application', 'chrome.exe'),
        os.path.join(os.environ.get('ProgramFiles(x86)', r'C:\Program Files (x86)'), 'Google', 'Chrome', 'Application', 'chrome.exe'),
        os.path.join(os.environ.get('LocalAppData', ''), 'Google', 'Chrome', 'Application', 'chrome.exe'),
    ]
    for exe in candidates:
        if exe and os.path.exists(exe):
            out = run_cmd([exe, '--version'])
            ver = parse_version(out)
            if ver:
                return ver, exe
    return None, None


def check_macos():
    candidates = [
        '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
        str(Path.home() / 'Applications/Google Chrome.app/Contents/MacOS/Google Chrome'),
    ]
    for exe in candidates:
        if os.path.exists(exe):
            out = run_cmd([exe, '--version'])
            ver = parse_version(out)
            if ver:
                return ver, exe
    return None, None


def check_linux():
    commands = [
        ['google-chrome', '--version'],
        ['google-chrome-stable', '--version'],
        ['chromium-browser', '--version'],
        ['chromium', '--version'],
    ]
    for cmd in commands:
        out = run_cmd(cmd)
        ver = parse_version(out)
        if ver:
            return ver, ' '.join(cmd[:-1])
    return None, None


def main():
    system = platform.system().lower()
    if 'windows' in system:
        ver, source = check_windows()
    elif 'darwin' in system:
        ver, source = check_macos()
    else:
        ver, source = check_linux()

    if not ver:
        print('UNKNOWN: Google Chrome version not found')
        sys.exit(2)

    version_str = '.'.join(str(x) for x in ver)
    fixed_str = '.'.join(str(x) for x in FIXED)

    if ver < FIXED:
        print(f'VULNERABLE: detected Chrome {version_str} via {source}; fixed version is {fixed_str} or newer')
        sys.exit(1)
    else:
        print(f'PATCHED: detected Chrome {version_str} via {source}; fixed threshold is {fixed_str}')
        sys.exit(0)


if __name__ == '__main__':
    main()

Sources

1. Google Chrome Releases - Stable Channel Update for Desktop (June 2, 2026)
2. Chromium issue tracker - Issue 500124500
3. NVD - CVE-2026-11084
4. CISA Known Exploited Vulnerabilities Catalog
5. FIRST EPSS
6. GreyNoise Vulnerability Prioritization FAQ
7. Shodan Help Center - Understanding Shodan Vulnerability Assessment