Use after free in File Input in Google Chrome on Mac prior to 149

CVE-2026-11100 is a use-after-free in Chrome's File Input handling on macOS. The affected range is Google Chrome on Mac before 149.0.7827.53; the June 2, 2026 stable release shipped 149.0.7827.53/54 for Windows/Mac, but this CVE's description is explicitly Mac-specific. The bug requires a malicious page and specific user UI gestures against file input elements, after which memory corruption may let the attacker potentially perform a sandbox escape.

The 9.6/CRITICAL CVSS label overstates real enterprise urgency. In practice this is a client-side, Mac-only, user-driven bug with no public exploitation, no KEV listing, no public PoC, and even Google's own Chromium release stream tags it Medium, which is a strong signal that the attack path has real friction. Still worth fixing, because browser sandbox escapes are prized for post-renderer compromise chains, but this is not a drop-everything fleet event.

Why this verdict

• Downgrade: Mac-only target set reduces reachable population immediately versus a cross-platform Chrome bug.
• Downgrade: user interaction is not generic; the attacker needs specific UI gestures around a file input, which is harder to mass-exploit than a passive page-load bug.
• Downgrade: this is client-side, not internet-facing; it does not expose your perimeter or create unauthenticated remote reachability into enterprise infrastructure.
• Downgrade: no exploitation pressure; no KEV listing, no public campaigns, and no public PoC were found.
• Downgrade: vendor's own signal is weaker; Chromium classifies the issue as Medium, which usually reflects meaningful exploit-chain friction even when CVSS math goes high.
• Upgrade pressure remains because a browser sandbox escape is strategically valuable if weaponized and Chrome is broadly deployed on user endpoints.

Why not higher?

To score this HIGH or CRITICAL, I would want either active exploitation, a public working exploit, or a substantially easier path than the advisory describes. Instead, the chain is narrowed by macOS-only applicability, required UI gestures, and the absence of evidence that attackers are successfully weaponizing it at scale.

Why not lower?

I would not bury this as LOW or IGNORE because use-after-free in a browser plus potential sandbox escape is still meaningful security debt on a high-value endpoint application. If an attacker already has a lure path into your Mac users, this bug could become a useful privilege-boundary break inside the browser.

1. Restrict unmanaged browser exposure on Macs — Force managed Macs onto enrolled Chrome builds and block or flag stale unmanaged copies. Because this is a MEDIUM verdict, there is no mitigation SLA — go straight to the 365-day remediation window, but do this sooner if your Mac fleet has poor Chrome update hygiene.
2. Harden web delivery paths — Use SWG, DNS filtering, safe browsing enforcement, and phishing-resistant mail controls to reduce the chance users ever reach the malicious page that starts this chain. There is no noisgate mitigation SLA for MEDIUM, so treat this as opportunistic hardening while you remediate within 365 days.
3. Watch for crash spikes on Mac Chrome — Monitor EDR, browser crash telemetry, and helpdesk noise for unusual Chrome crashes or repeated failures around file selection flows on macOS. This will not prove exploitation, but it can surface risky stragglers while patch rollout proceeds inside the 365-day remediation window.
4. Prioritize high-risk Mac cohorts — Move internet-facing staff, executives, admins, and researchers to current Chrome first because they are the most likely lure targets. Even without a mitigation SLA, tightening those cohorts early cuts the highest-value exposure while standard remediation completes within 365 days.

Run this locally on each target Mac or through your Mac management agent. Invoke it as bash chrome_cve_2026_11100_check.sh "/Applications/Google Chrome.app"; no root is required if Chrome is installed in a readable location. It checks the installed Chrome version and prints VULNERABLE, PATCHED, or UNKNOWN.

#!/bin/bash
# Check Google Chrome on macOS for CVE-2026-11100 exposure
# Usage: bash chrome_cve_2026_11100_check.sh "/Applications/Google Chrome.app"
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN / unable to determine

set -u

APP_PATH="${1:-/Applications/Google Chrome.app}"
REQUIRED_VERSION="149.0.7827.53"
PLIST_BUDDY="/usr/libexec/PlistBuddy"

version_ge() {
  # Returns 0 if $1 >= $2, else 1
  local IFS='.'
  local i
  local -a v1=($1) v2=($2)

  # Pad shorter array with zeros
  local len1=${#v1[@]}
  local len2=${#v2[@]}
  local maxlen=$(( len1 > len2 ? len1 : len2 ))

  for ((i=len1; i<maxlen; i++)); do v1[i]=0; done
  for ((i=len2; i<maxlen; i++)); do v2[i]=0; done

  for ((i=0; i<maxlen; i++)); do
    local a=${v1[i]}
    local b=${v2[i]}
    # force base-10 to avoid octal interpretation
    a=$((10#$a))
    b=$((10#$b))
    if (( a > b )); then return 0; fi
    if (( a < b )); then return 1; fi
  done
  return 0
}

if [[ ! -d "$APP_PATH" ]]; then
  echo "UNKNOWN - Chrome app not found at: $APP_PATH"
  exit 2
fi

INFO_PLIST="$APP_PATH/Contents/Info.plist"
if [[ ! -f "$INFO_PLIST" ]]; then
  echo "UNKNOWN - Info.plist not found at: $INFO_PLIST"
  exit 2
fi

VERSION=""
if [[ -x "$PLIST_BUDDY" ]]; then
  VERSION="$($PLIST_BUDDY -c 'Print :CFBundleShortVersionString' "$INFO_PLIST" 2>/dev/null || true)"
fi

if [[ -z "$VERSION" ]]; then
  VERSION="$(defaults read "$INFO_PLIST" CFBundleShortVersionString 2>/dev/null || true)"
fi

if [[ -z "$VERSION" ]]; then
  echo "UNKNOWN - Could not determine Chrome version"
  exit 2
fi

if version_ge "$VERSION" "$REQUIRED_VERSION"; then
  echo "PATCHED - Installed Chrome version $VERSION is >= $REQUIRED_VERSION"
  exit 0
else
  echo "VULNERABLE - Installed Chrome version $VERSION is < $REQUIRED_VERSION"
  exit 1
fi

Sources

1. Google Chrome Releases - Stable Channel Update for Desktop (June 2, 2026)
2. Google Chrome Releases - Early Stable Update for Desktop (May 29, 2026)
3. Chromium issue 500416901 reference
4. Tenable CVE record for CVE-2026-11100
5. Vulnerability-Lookup entry for CVE-2026-11100
6. CISA Known Exploited Vulnerabilities Catalog
7. FIRST EPSS overview
8. Google Chrome Help - Update Google Chrome