Uninitialized Use in ANGLE in Google Chrome prior to 149

CVE-2026-11090 is an *uninitialized use* bug in Chrome's ANGLE graphics layer, the component that translates browser graphics calls to platform GPU APIs. The affected range is Google Chrome versions *before* 149.0.7827.53; Google's June 2, 2026 stable release shipped 149.0.7827.53 for Linux and 149.0.7827.53/54 for Windows and macOS. The stated impact is cross-origin data leakage from a crafted HTML page, not code execution.

Google's *Medium / 6.5* label is broadly fair, but a little generous for enterprise patch triage. The exploit chain needs a user to render attacker-controlled content in a vulnerable Chrome build, then successfully exercise the ANGLE path to leak useful data; that is meaningful for targeted theft, but it is not wormable, not a server-side foothold, and there is no current KEV listing, public exploit evidence, or scary EPSS signal pushing this into urgent territory.

Why this verdict

• User interaction drags the score down: the attacker needs a victim to render hostile web content, which implies phishing, malvertising, or a compromised trusted site rather than straight unauthenticated remote reach.
• This is client-side and non-scannable: there is no exposed service to sweep at internet scale, so population reach depends on successful content delivery and user browsing behavior, not raw network exposure.
• ANGLE/GPU path variability adds real friction: browser graphics bugs often depend on backend, driver, acceleration, and platform specifics, which hurts reliability in real enterprise fleets.
• No exploit pressure today: no KEV, no public in-the-wild reporting, no public PoC found, and the supplied EPSS is extremely low.
• Why it does not fall further: Chrome is everywhere, and a cross-origin data leak in a browser can still matter for SSO-heavy environments where users hold valuable live sessions.

Why not higher?

This is not code execution, not sandbox escape, and not a server-side exposure you can hit blindly from the internet. The chain requires user interaction and then a somewhat finicky client-side rendering condition to turn a bug into useful data theft, which is a meaningful downgrade from the vendor baseline.

Why not lower?

Cross-origin leakage inside the dominant enterprise browser is still a legitimate security issue, especially for high-value users with active SaaS sessions. Even without RCE, confidentiality loss in a browser can translate into real business impact if an attacker can steal tokens, page contents, or sensitive application data.

1. Enforce browser auto-update — Make sure managed endpoints are actually receiving and applying Chrome stable updates, then verify they move to 149.0.7827.53+. For a MEDIUM verdict there is no mitigation SLA — go straight to the 365-day remediation window, but in practice browsers should not sit that long in lagging channels.
2. Harden risky user cohorts — For admins, finance, executives, and researchers, apply stricter web isolation or remote browser isolation where available. This reduces the chance that a malicious page can exercise the vulnerable client path while you complete remediation within the 365-day window.
3. Restrict untrusted browsing paths — Use secure web gateway policy to reduce exposure to newly registered domains, ad-tech noise, and uncategorized destinations. This does not fix the bug, but it reduces the odds of step 1 in the chain while you remediate.
4. Watch browser laggards — Inventory endpoints still below 149.0.7827.53 and tie them to owners, channels, and update failures. The real operational risk here is not exploit hype; it is unmanaged browser drift across thousands of hosts.

Run this on the target endpoint or through your fleet management agent. Invoke it as python3 check_chrome_cve_2026_11090.py on Linux/macOS or py check_chrome_cve_2026_11090.py on Windows; no administrator rights are normally required because it only reads local executable paths and queries the browser version.

#!/usr/bin/env python3
# Check local Google Chrome version for CVE-2026-11090 exposure
# Outputs: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import shutil
import subprocess
import sys
from pathlib import Path

PATCHED_MIN = (149, 0, 7827, 53)


def parse_version(text):
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def version_to_str(v):
    return '.'.join(str(x) for x in v)


def get_candidates():
    system = platform.system().lower()
    candidates = []

    if system == 'windows':
        env = os.environ
        for base in [env.get('PROGRAMFILES'), env.get('PROGRAMFILES(X86)'), env.get('LOCALAPPDATA')]:
            if not base:
                continue
            candidates.append(os.path.join(base, 'Google', 'Chrome', 'Application', 'chrome.exe'))
        where = shutil.which('chrome') or shutil.which('chrome.exe')
        if where:
            candidates.append(where)

    elif system == 'darwin':
        candidates.extend([
            '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
            str(Path.home() / 'Applications/Google Chrome.app/Contents/MacOS/Google Chrome'),
        ])
        where = shutil.which('google-chrome') or shutil.which('chrome')
        if where:
            candidates.append(where)

    else:
        candidates.extend([
            '/usr/bin/google-chrome',
            '/usr/bin/google-chrome-stable',
            '/snap/bin/chromium',
        ])
        for name in ['google-chrome', 'google-chrome-stable', 'chrome', 'chromium', 'chromium-browser']:
            where = shutil.which(name)
            if where:
                candidates.append(where)

    # Deduplicate while preserving order
    seen = set()
    deduped = []
    for c in candidates:
        if c and c not in seen:
            deduped.append(c)
            seen.add(c)
    return deduped


def get_version(binary):
    try:
        result = subprocess.run([binary, '--version'], capture_output=True, text=True, timeout=10)
        output = (result.stdout or '') + ' ' + (result.stderr or '')
        return parse_version(output)
    except Exception:
        return None


def main():
    candidates = get_candidates()
    found = []

    for c in candidates:
        if os.path.exists(c) or shutil.which(c):
            v = get_version(c)
            if v:
                found.append((c, v))

    if not found:
        print('UNKNOWN - Google Chrome executable not found or version unreadable')
        sys.exit(2)

    # Use the highest discovered version in case multiple channels are installed
    best_path, best_version = sorted(found, key=lambda x: x[1], reverse=True)[0]

    if best_version >= PATCHED_MIN:
        print(f'PATCHED - {best_path} version {version_to_str(best_version)} >= {version_to_str(PATCHED_MIN)}')
        sys.exit(0)
    else:
        print(f'VULNERABLE - {best_path} version {version_to_str(best_version)} < {version_to_str(PATCHED_MIN)}')
        sys.exit(1)


if __name__ == '__main__':
    main()

Sources

1. Google Chrome stable channel update for desktop (Chrome 149)
2. Chromium issue 500161302
3. Chromium Security overview
4. ANGLE project documentation
5. CISA Known Exploited Vulnerabilities catalog
6. FIRST EPSS API documentation
7. FIRST EPSS data and report documentation
8. StatCounter desktop browser market share