Uninitialized Use in Media in Google Chrome prior to 149

CVE-2026-11089 is an uninitialized-use bug in Chrome's Media component. Affected builds are Chrome versions *before* 149.0.7827.53 on Linux and the corresponding 149.0.7827.53/54 desktop rollout on Windows and macOS. The stated impact is confidentiality: after the attacker already has renderer-process compromise, a crafted HTML page can read sensitive data left in process memory.

Google's MEDIUM 6.5 label is technically fair in isolation, but operationally it overstates patch urgency for most enterprise fleets. The decisive friction is that this bug is *not* initial access, *not* a sandbox escape, and *not* a direct RCE; it is a second-stage memory disclosure that only matters once another bug has already landed the attacker inside the renderer.

Why this verdict

• Big downgrade for attacker position: the attacker must already have a compromised renderer process, which implies a separate exploit or prior browser compromise before this CVE becomes relevant.
• Further downgrade for exposed population: this is not an unauthenticated internet-facing service flaw; reachable targets are only users on vulnerable Chrome builds who both load attacker content and are hit by a successful first-stage renderer exploit.
• Downward pressure from modern controls: Safe Browsing, content filtering, browser sandboxing, and Site Isolation each remove or constrain pieces of the chain, which lowers practical exploitability even though the confidentiality impact is rated high in CVSS.
• Kept above IGNORE because browsers are everywhere: Chrome is ubiquitous, and info leaks are useful to attackers building reliable exploit chains or trying to recover in-process secrets after a renderer foothold.

Why not higher?

There is no direct sandbox escape, no host-level code execution, and no evidence of active exploitation in the retrieved sources. Most importantly, the vulnerability is not independently reachable as an initial-access bug; it needs another Chrome exploit to go first.

Why not lower?

This is still a real security boundary erosion inside one of the most widely deployed enterprise applications. If an attacker already has renderer execution, memory disclosure bugs can materially improve exploit reliability, expose tokens, or help a later breakout stage.

1. Enforce Chrome auto-update — Keep managed Chrome channels pinned to vendor-supported current builds so second-stage browser bugs age out naturally. For a LOW verdict there is no SLA beyond backlog hygiene, so keep this on the normal browser-update cadence rather than running an emergency change.
2. Keep Safe Browsing enabled — Safe Browsing reduces the odds that users ever load the malicious content needed to start a browser exploit chain. Maintain the managed policy setting continuously; for a LOW verdict this is backlog hygiene, not an emergency exception process.
3. Do not weaken renderer isolation — Avoid enterprise policies, flags, or troubleshooting habits that disable Chrome sandboxing or isolation features, because those are exactly the controls that reduce damage after renderer compromise. Review deviations during normal hardening cycles; LOW verdict means no special accelerated deadline.
4. Prioritize browser exploit telemetry — Make sure EDR, crash telemetry, and browser event collection can flag unusual renderer crashes, suspicious child processes, or exploit-protection hits. This is the most useful detective control when a CVE is only relevant as part of a larger browser chain.

Run this on the target endpoint or through your EDR/remote execution tooling as a standard user; admin rights are usually not required because it only reads Chrome version metadata. Invoke it with python3 chrome_cve_2026_11089_check.py on macOS/Linux or py chrome_cve_2026_11089_check.py on Windows. It reports VULNERABLE, PATCHED, or UNKNOWN by comparing the locally installed Google Chrome version to 149.0.7827.53.

#!/usr/bin/env python3
# CVE-2026-11089 Chrome version check
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN

import os
import platform
import re
import subprocess
import sys
from pathlib import Path

PATCHED = (149, 0, 7827, 53)


def parse_version(text):
    if not text:
        return None
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def cmp_version(a, b):
    return (a > b) - (a < b)


def run_cmd(cmd):
    try:
        p = subprocess.run(cmd, capture_output=True, text=True, timeout=10)
        out = (p.stdout or '') + (p.stderr or '')
        return out.strip()
    except Exception:
        return ''


def windows_candidates():
    candidates = []
    pf = os.environ.get('ProgramFiles', r'C:\Program Files')
    pfx86 = os.environ.get('ProgramFiles(x86)', r'C:\Program Files (x86)')
    local = os.environ.get('LocalAppData', '')
    candidates.extend([
        Path(pf) / 'Google/Chrome/Application/chrome.exe',
        Path(pfx86) / 'Google/Chrome/Application/chrome.exe',
    ])
    if local:
        candidates.append(Path(local) / 'Google/Chrome/Application/chrome.exe')
    return candidates


def get_windows_version():
    for exe in windows_candidates():
        if exe.exists():
            cmd = [
                'powershell', '-NoProfile', '-Command',
                f"(Get-Item '{str(exe)}').VersionInfo.ProductVersion"
            ]
            out = run_cmd(cmd)
            ver = parse_version(out)
            if ver:
                return ver, str(exe)
    return None, None


def get_macos_version():
    app = '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'
    if Path(app).exists():
        out = run_cmd([app, '--version'])
        ver = parse_version(out)
        if ver:
            return ver, app
    return None, None


def get_linux_version():
    cmds = [
        ['google-chrome', '--version'],
        ['google-chrome-stable', '--version'],
        ['/opt/google/chrome/chrome', '--version'],
    ]
    for cmd in cmds:
        out = run_cmd(cmd)
        ver = parse_version(out)
        if ver:
            return ver, ' '.join(cmd)
    return None, None


def main():
    system = platform.system().lower()

    if 'windows' in system:
        ver, source = get_windows_version()
    elif 'darwin' in system:
        ver, source = get_macos_version()
    else:
        ver, source = get_linux_version()

    if not ver:
        print('UNKNOWN: Google Chrome not found or version unreadable')
        sys.exit(2)

    if cmp_version(ver, PATCHED) >= 0:
        print(f'PATCHED: found Chrome {".".join(map(str, ver))} via {source}')
        sys.exit(0)
    else:
        print(f'VULNERABLE: found Chrome {".".join(map(str, ver))} via {source}; need >= 149.0.7827.53')
        sys.exit(1)


if __name__ == '__main__':
    main()

Sources

1. Google Chrome Releases - Stable Channel Update for Desktop (June 2, 2026)
2. Google Chrome Releases - Early Stable Update for Desktop (May 29, 2026)
3. Chromium Security - Site Isolation overview
4. Chromium Security - Memory safety
5. CISA Known Exploited Vulnerabilities Catalog
6. FIRST EPSS overview
7. Google Chrome Help - Choose your Safe Browsing protection level in Chrome
8. SecurityWeek - Chrome 149 Patches 429 Vulnerabilities