Insufficient policy enforcement in DevTools in Google Chrome prior to 149

The authoritative public record does not support the user-supplied 8.8/HIGH story. The description you provided maps to CVE-2026-11212, not CVE-2026-11092: Google says Chrome before 149.0.7827.53 let a malicious Chrome extension abuse a DevTools policy gap to leak cross-origin data. A separate CVE, CVE-2026-11092, is also a DevTools policy-enforcement bug in Chrome 149, but the full public description, CVSS, and EPSS you supplied belong to CVE-2026-11212.

In real enterprise conditions this lands MEDIUM, not HIGH. The decisive friction is that the attacker must first get a user to install a malicious extension; that is already a distinct compromise step that good browser policy, extension allowlisting, Safe Browsing, store controls, and user privilege limits should suppress. The impact is also narrower than a code-exec bug: the public scoring for the matching record is 4.3 / MEDIUM with confidentiality-only impact, no integrity or availability loss.

Why this verdict

• Authoritative baseline is already lower: the matching public record is 4.3/MEDIUM, not the user-supplied 8.8/HIGH.
• Attacker position is post-social-engineering: exploitation requires a user-installed malicious extension, which implies the attacker has already won a meaningful initial foothold in the browser.
• Reachable population is narrowed by policy: enterprises that enforce extension allowlists/blocklists or managed-browser controls cut exposure sharply compared with consumer Chrome.
• Blast radius is user-session scoped: public scoring shows confidentiality loss only, with no integrity or availability impact and no host-level code execution.

Why not higher?

This is not unauthenticated drive-by code execution, and it is not a server-side remotely reachable service you can scan from the internet. The exploit chain depends on extension installation, which compounds friction and limits the affected population to users who can be socially engineered or whose browser policy is weak.

Why not lower?

It is still a browser-wide issue in an extremely common application, and the data at risk may include authenticated enterprise SaaS content. If your extension governance is loose, this bug can turn a commodity malicious extension into a more capable cross-origin data thief, so it is not something to ignore outright.

1. Block unmanaged extensions — Use Chrome Enterprise ExtensionSettings / ExtensionInstallBlocklist controls to stop arbitrary add-on installs and disable already-blocklisted extensions. For a MEDIUM verdict there is no noisgate mitigation SLA; this is still the best control to apply first because it removes the exploit precondition.
2. Restrict DevTools where business allows — Use DeveloperToolsAvailability to reduce DevTools exposure on managed browsers, especially high-risk user groups and kiosk/shared profiles. This will not replace patching, but it reduces the attack surface while you roll browser updates.
3. Inventory and hunt extension drift — Pull extension IDs from managed-browser telemetry and compare against your approved set; investigate newly installed, unapproved, or recently enabled extensions. This is the fastest way to find users who could actually traverse the exploit chain.
4. Watch browser egress from sensitive users — Apply SWG/CASB/DLP focus to browser-origin outbound traffic for admins, finance, engineering, and other SaaS-heavy roles. The likely impact here is session-adjacent data theft, so egress monitoring gives you a practical backstop.
5. Roll Chrome to 149.0.7827.53+ — Standardize browser rollout to 149.0.7827.53 or later across Windows, macOS, Linux, and aligned Android channels. For a MEDIUM verdict there is no mitigation SLA — go straight to the 365-day remediation window, but most orgs should finish this in the next normal browser release cadence, not let it age.

Run this on the target endpoint or through your fleet management tool with normal user rights; admin is not required unless your environment blocks access to the browser binary. Example: python3 check_chrome_cve_2026_11212.py on macOS/Linux or py check_chrome_cve_2026_11212.py on Windows. It checks installed Chrome/Chromium version only and reports VULNERABLE, PATCHED, or UNKNOWN.

#!/usr/bin/env python3
# check_chrome_cve_2026_11212.py
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN / unable to determine

import os
import platform
import re
import subprocess
import sys
from typing import Optional, Tuple

THRESHOLD = (149, 0, 7827, 53)


def parse_version(text: str) -> Optional[Tuple[int, int, int, int]]:
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def run_cmd(cmd):
    try:
        p = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, timeout=10)
        out = (p.stdout or '') + (p.stderr or '')
        return out.strip()
    except Exception:
        return ''


def get_windows_version() -> Optional[Tuple[int, int, int, int]]:
    candidates = [
        os.path.expandvars(r'%ProgramFiles%\Google\Chrome\Application\chrome.exe'),
        os.path.expandvars(r'%ProgramFiles(x86)%\Google\Chrome\Application\chrome.exe'),
        os.path.expandvars(r'%LocalAppData%\Google\Chrome\Application\chrome.exe'),
        os.path.expandvars(r'%ProgramFiles%\Chromium\Application\chrome.exe'),
        os.path.expandvars(r'%ProgramFiles(x86)%\Chromium\Application\chrome.exe'),
    ]
    for path in candidates:
        if os.path.exists(path):
            ps = [
                'powershell', '-NoProfile', '-Command',
                f"(Get-Item '{path}').VersionInfo.ProductVersion"
            ]
            out = run_cmd(ps)
            ver = parse_version(out)
            if ver:
                return ver
    return None


def get_macos_version() -> Optional[Tuple[int, int, int, int]]:
    candidates = [
        '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
        '/Applications/Chromium.app/Contents/MacOS/Chromium',
    ]
    for path in candidates:
        if os.path.exists(path):
            out = run_cmd([path, '--version'])
            ver = parse_version(out)
            if ver:
                return ver
    return None


def get_linux_version() -> Optional[Tuple[int, int, int, int]]:
    candidates = [
        ['google-chrome', '--version'],
        ['google-chrome-stable', '--version'],
        ['chromium', '--version'],
        ['chromium-browser', '--version'],
        ['/opt/google/chrome/chrome', '--version'],
    ]
    for cmd in candidates:
        out = run_cmd(cmd)
        ver = parse_version(out)
        if ver:
            return ver
    return None


def main():
    system = platform.system().lower()
    if 'windows' in system:
        ver = get_windows_version()
    elif 'darwin' in system:
        ver = get_macos_version()
    elif 'linux' in system:
        ver = get_linux_version()
    else:
        print('UNKNOWN - unsupported platform')
        sys.exit(2)

    if not ver:
        print('UNKNOWN - Chrome/Chromium version not found')
        sys.exit(2)

    version_str = '.'.join(str(x) for x in ver)
    if ver < THRESHOLD:
        print(f'VULNERABLE - installed version {version_str} is below 149.0.7827.53')
        sys.exit(1)
    else:
        print(f'PATCHED - installed version {version_str} is at or above 149.0.7827.53')
        sys.exit(0)


if __name__ == '__main__':
    main()

Sources

1. NVD - CVE-2026-11212
2. Chrome stable channel update for desktop - June 2 2026
3. Chrome early stable updates label
4. GitHub Advisory Database - GHSA-3cxh-6mgp-qvhv
5. Chrome Enterprise policy - DeveloperToolsAvailability
6. Chrome Enterprise Help - Allow or block apps and extensions
7. CISA Known Exploited Vulnerabilities Catalog
8. Chrowned by an Extension: Abusing the Chrome DevTools Protocol through the Debugger API