Insufficient validation of untrusted input in Codecs in Google Chrome prior to 149

CVE-2026-11095 is a Google Chrome Codecs input-validation flaw affecting desktop Chrome before 149.0.7827.53 on Linux and before 149.0.7827.53/.54 on Windows and macOS. Public detail is sparse because Chromium keeps many bug records restricted until most users are patched, but the release notes place it in the media-processing path: attacker-controlled content can reach Chrome's codec stack through web pages or downloaded media.

The provided CRITICAL 9.6 label overstates day-to-day enterprise risk. Google's own release notes classify CVE-2026-11095 as Medium, there is no KEV entry, EPSS is extremely low, and no public exploit or mature PoC turned up in source review. I still land at HIGH, not Medium, because Chrome is ubiquitous and media-path bugs on endpoints can become high-consequence when chained, but this is not an internet-worm or edge-service fire.

Why this verdict

• Down from 9.6 because it is not an edge-service bug: attacker reach requires a user to browse or open attacker-controlled content, which immediately narrows reachable population versus unauthenticated remote server flaws.
• Down again because Chrome's sandbox is real friction: a single media-parser issue still has to produce a reliable post-parser security outcome through modern browser and OS mitigations.
• Not lower because Chrome is everywhere: even medium-quality browser bugs matter at 10,000-host scale, especially on unmanaged laptops, VDI gold images, privileged admin workstations, and kiosks that often lag relaunches and updates.

Why not higher?

I do not see KEV status, public exploitation reporting, or a public exploit chain that would justify a CRITICAL emergency. More importantly, the authoritative Chrome release notes mark this CVE as Medium, and the bug remains restricted, which usually means defenders should patch promptly but not declare internet-breach conditions from the CVSS alone.

Why not lower?

I am not comfortable dropping this to Medium because browser codec bugs sit on an extremely common trust boundary and land on one of the most broadly deployed apps in the enterprise. Even without proof of exploitation, a Chrome fleet stuck below the fixed build leaves a high-volume user population exposed to malicious web content every day.

1. Enforce Chrome auto-update and forced relaunch — Make browser version drift the first thing you kill. Use enterprise policy or endpoint management to enforce update checks and relaunch prompts, and get this control in place within 30 days for any cohort that is not already on evergreen patching.
2. Block stale Chrome from compliance-sensitive access — Use device posture, NAC, or conditional access to deny access to high-value SaaS/admin surfaces from endpoints running Chrome below the fixed build. This reduces business impact from stragglers and should be deployed within 30 days.
3. Separate admin activity from general browsing — Keep privileged administration off daily-driver browsing sessions by using PAWs, hardened jump hosts, or separate browser profiles/devices. This does not remove the bug, but it cuts blast radius if exploitation lands; treat it as a compensating control to tighten within 30 days.
4. Prefer remote/browser isolation for risky user groups — Executives, finance, researchers, and users exposed to open internet content benefit most from browser isolation or sandboxed remote browsing. If you have the product, apply it to the riskiest cohorts within 30 days while remediation catches up.

Run this on the target endpoint or through your software inventory tooling. Invoke it with python3 check_chrome_149.py on macOS/Linux or py check_chrome_149.py on Windows; no admin rights are normally required, but some installation paths may need standard read access.

#!/usr/bin/env python3
# check_chrome_149.py
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN

import os
import platform
import re
import subprocess
import sys
from shutil import which

TARGETS = {
    'Windows': '149.0.7827.54',
    'Darwin': '149.0.7827.54',
    'Linux': '149.0.7827.53',
}

LABELS = {
    'Windows': 'Google Chrome',
    'Darwin': 'Google Chrome',
    'Linux': 'google-chrome',
}

def parse_version(text):
    m = re.search(r'(\d+\.\d+\.\d+\.\d+)', text)
    return m.group(1) if m else None


def ver_tuple(v):
    return tuple(int(x) for x in v.split('.'))


def run_cmd(cmd):
    try:
        p = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, timeout=10)
        if p.returncode == 0:
            return p.stdout.strip() or p.stderr.strip()
        return None
    except Exception:
        return None


def get_version_windows():
    candidates = [
        os.path.expandvars(r'%ProgramFiles%\Google\Chrome\Application\chrome.exe'),
        os.path.expandvars(r'%ProgramFiles(x86)%\Google\Chrome\Application\chrome.exe'),
        os.path.expandvars(r'%LocalAppData%\Google\Chrome\Application\chrome.exe'),
    ]
    for path in candidates:
        if os.path.exists(path):
            ps = [
                'powershell', '-NoProfile', '-Command',
                f"(Get-Item '{path}').VersionInfo.ProductVersion"
            ]
            out = run_cmd(ps)
            v = parse_version(out or '')
            if v:
                return path, v
    return None, None


def get_version_macos():
    candidates = [
        '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
        os.path.expanduser('~/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'),
    ]
    for path in candidates:
        if os.path.exists(path):
            out = run_cmd([path, '--version'])
            v = parse_version(out or '')
            if v:
                return path, v
    return None, None


def get_version_linux():
    candidates = ['google-chrome', 'google-chrome-stable', 'chromium', 'chromium-browser']
    for bin_name in candidates:
        resolved = which(bin_name)
        if resolved:
            out = run_cmd([resolved, '--version'])
            v = parse_version(out or '')
            if v:
                return resolved, v
    return None, None


def main():
    os_name = platform.system()
    target = TARGETS.get(os_name)
    if not target:
        print('UNKNOWN: Unsupported OS for this check')
        sys.exit(2)

    if os_name == 'Windows':
        path, version = get_version_windows()
    elif os_name == 'Darwin':
        path, version = get_version_macos()
    else:
        path, version = get_version_linux()

    if not version:
        print('UNKNOWN: Chrome not found or version unreadable')
        sys.exit(2)

    if ver_tuple(version) >= ver_tuple(target):
        print(f'PATCHED: {LABELS[os_name]} {version} at {path} (fixed threshold {target})')
        sys.exit(0)
    else:
        print(f'VULNERABLE: {LABELS[os_name]} {version} at {path} (requires >= {target})')
        sys.exit(1)

if __name__ == '__main__':
    main()

Sources

1. Google Chrome stable channel update for Desktop (Chrome 149)
2. Google Chrome early stable update for Desktop
3. Chromium issue 500293394
4. Canadian Centre for Cyber Security advisory AV26-544
5. CISA Known Exploited Vulnerabilities Catalog
6. Chromium Security
7. Chromium Site Isolation
8. Quanteta CVE Tracker