Integer overflow in ANGLE in Google Chrome prior to 149

CVE-2026-11088 is an integer overflow in Chrome's ANGLE graphics layer, affecting Chrome builds before 149.0.7827.53. Based on the supplied description, the bug is only reachable after an attacker has already compromised the renderer process, which makes this a classic post-renderer browser exploit primitive rather than a stand-alone web-to-host compromise.

Google's CRITICAL 9.6 label is fair only if you grade the *full potential impact in a perfect exploit chain*. For enterprise patching, that overstates the real-world priority because the hardest part of the intrusion is not this bug; it's the prerequisite renderer compromise. No KEV listing, a very low EPSS 0.00035, and no public exploitation evidence push this down from emergency to disciplined browser hygiene.

Why this verdict

• Big downgrade for attacker position: the attacker must already control the renderer process, which implies a prior compromise stage and makes this a chain component, not initial access.
• Population narrowing: every prerequisite compounds downward pressure — user browsing, vulnerable build, correct graphics path, and a separate renderer exploit all have to line up.
• Low demand signal: no KEV, no public exploitation evidence, and EPSS 0.00035 say operators are not broadly prioritizing this bug right now.

Why not higher?

If this were a one-click, stand-alone web-to-host bug, the vendor's critical framing would be much closer to reality. But the supplied description bakes in a massive prerequisite: the attacker must first compromise the renderer, which is exactly the kind of friction that should crush patch priority when you're triaging a 10,000-host fleet.

Why not lower?

It is still a browser memory-safety flaw in a security-boundary-adjacent component with potentially serious chain value. On high-risk users, browsers are common initial-access battlegrounds, and second-stage sandbox escapes deserve more respect than generic backlog noise.

1. Enforce auto-update and relaunch — Make sure Chrome update policy is not blocked and force relaunch prompts or restart deadlines so the fixed build is actually loaded into memory. For a MEDIUM verdict there is no mitigation SLA — go straight to the 365-day remediation window, but for browsers you should still clean up laggards early because stale clients accumulate chain risk.
2. Prioritize high-risk user rings — Patch admins, developers, finance, executives, and users who regularly handle untrusted web content first. Even without a noisgate mitigation deadline, these populations are the most likely to face targeted exploit chaining, so move them to the fixed Chrome train well before the broader 365-day remediation ceiling.
3. Keep browser exploit mitigations intact — Do not weaken site isolation, sandboxing, Safe Browsing, or OS exploit protections in pursuit of compatibility unless you have a documented exception. These controls specifically raise the cost of the renderer-first precondition that makes this CVE materially less urgent.
4. Restrict advanced web graphics where justified — For highly sensitive cohorts or kiosk workloads, consider policy-based reduction of WebGL/WebGPU exposure if business use allows it. This is not required for the whole fleet, but it is a practical temporary hardening move while you drain old browser versions.

Run this on the target endpoint or through your software-distribution/MDM agent. Invoke it with python3 check_chrome_cve_2026_11088.py on macOS/Linux or py check_chrome_cve_2026_11088.py on Windows; no admin rights are required if the Chrome binary is in a standard install path, but wider filesystem access improves coverage.

#!/usr/bin/env python3
# check_chrome_cve_2026_11088.py
# Determine whether locally installed Google Chrome is below 149.0.7827.53.
# Outputs one of: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import subprocess
import sys
from pathlib import Path

THRESHOLD = (149, 0, 7827, 53)


def parse_version(text):
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def compare_versions(a, b):
    return (a > b) - (a < b)


def try_cmd(cmd):
    try:
        p = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, timeout=10)
        out = (p.stdout or '') + '\n' + (p.stderr or '')
        return p.returncode, out.strip()
    except Exception:
        return None, ''


def check_windows():
    candidates = [
        os.path.join(os.environ.get('ProgramFiles', r'C:\Program Files'), 'Google', 'Chrome', 'Application', 'chrome.exe'),
        os.path.join(os.environ.get('ProgramFiles(x86)', r'C:\Program Files (x86)'), 'Google', 'Chrome', 'Application', 'chrome.exe'),
        os.path.join(os.environ.get('LocalAppData', ''), 'Google', 'Chrome', 'Application', 'chrome.exe'),
    ]
    for c in candidates:
        if c and os.path.exists(c):
            rc, out = try_cmd([
                'powershell', '-NoProfile', '-Command',
                f"(Get-Item '{c}').VersionInfo.ProductVersion"
            ])
            ver = parse_version(out)
            if ver:
                return c, ver
    return None, None


def check_macos():
    candidates = [
        '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
        str(Path.home() / 'Applications/Google Chrome.app/Contents/MacOS/Google Chrome'),
    ]
    for c in candidates:
        if os.path.exists(c):
            rc, out = try_cmd([c, '--version'])
            ver = parse_version(out)
            if ver:
                return c, ver
    return None, None


def check_linux():
    cmds = [
        ['google-chrome', '--version'],
        ['google-chrome-stable', '--version'],
        ['chromium-browser', '--version'],
        ['chromium', '--version'],
    ]
    for cmd in cmds:
        rc, out = try_cmd(cmd)
        ver = parse_version(out)
        if ver:
            return ' '.join(cmd[:-1]), ver

    candidates = [
        '/opt/google/chrome/chrome',
        '/usr/bin/google-chrome',
        '/usr/bin/google-chrome-stable',
        '/snap/bin/chromium',
        '/usr/bin/chromium-browser',
        '/usr/bin/chromium',
    ]
    for c in candidates:
        if os.path.exists(c):
            rc, out = try_cmd([c, '--version'])
            ver = parse_version(out)
            if ver:
                return c, ver
    return None, None


def main():
    system = platform.system().lower()
    path = None
    ver = None

    if 'windows' in system:
        path, ver = check_windows()
    elif 'darwin' in system:
        path, ver = check_macos()
    elif 'linux' in system:
        path, ver = check_linux()
    else:
        print('UNKNOWN: unsupported OS')
        sys.exit(2)

    if not ver:
        print('UNKNOWN: Chrome/Chromium not found or version unreadable')
        sys.exit(2)

    status = 'PATCHED' if compare_versions(ver, THRESHOLD) >= 0 else 'VULNERABLE'
    print(f'{status}: version={".".join(map(str, ver))} path={path} threshold={".".join(map(str, THRESHOLD))}')
    sys.exit(0 if status == 'PATCHED' else 1)


if __name__ == '__main__':
    main()

Sources

1. Chrome Releases - Early Stable Update for Desktop (149.0.7827.53/.54)
2. Chrome Releases homepage
3. CISA Known Exploited Vulnerabilities Catalog
4. FIRST EPSS overview
5. FIRST EPSS API documentation
6. SecurityWeek coverage of Chrome 149 security fixes
7. PCWorld coverage of Chrome 149 security fixes
8. CVE.org analogous Chrome post-renderer CVE pattern