Inappropriate implementation in Isolated Web Apps in Google Chrome prior to 149

CVE-2026-11102 affects Google Chrome versions before 149.0.7827.53 and sits in Isolated Web Apps (IWA). The published description says a remote attacker can get arbitrary code execution inside the Chrome sandbox by delivering a malicious file. That matters: this is not generic drive-by browser RCE against every tab; it is tied to the IWA feature set and a file-based trigger path.

The plain CVSS story overstates enterprise urgency. Yes, AV:N/AC:L/PR:N/UI:R plus code execution sounds nasty, but in real deployments the chain is squeezed by three big friction points: user interaction is mandatory, impact is contained to the sandbox, and IWA is a niche, admin-managed feature rather than the default Chrome browsing path. Chrome itself labeled this bug Medium in the June 2, 2026 stable advisory, and that better matches operational reality than the later 8.8 enrichment.

Why this verdict

• Baseline correction: the 8.8 score models generic browser RCE inputs, but Google's own stable-channel advisory tagged this CVE Medium, which already hints the raw CVSS is not telling the whole deployment story.
• Population is tiny compared with 'all Chrome': exploitation requires the Isolated Web Apps feature path, and Google says initial IWA availability is for Chrome Enterprise-managed ChromeOS and allowlisted deployments. That moves this from internet-scale browser risk to a much narrower subset.
• Attacker path needs user action: the vector includes UI:R and the description calls out a malicious file. That implies phishing, file delivery, and user processing rather than silent drive-by compromise.
• Impact stops at the sandbox: the published description is explicit about arbitrary code execution inside a sandbox. For real workstation takeover, an attacker normally needs a second-stage sandbox escape or local privilege escalation.
• Threat intel is cold: no KEV listing, no public exploitation evidence, and EPSS 0.00033 all push down on urgency.

Why not higher?

If this were a normal browsing-path bug with no user interaction and evidence of active exploitation, it would stay high. It does not. The combination of IWA-only reachability, file interaction, and sandboxed impact makes the 8.8 label too aggressive for enterprise patch triage.

Why not lower?

I did not push this to LOW because the end state is still code execution, and browser bugs remain useful footholds when paired with social engineering. Also, some organizations do use managed ChromeOS and high-trust app models; in those pockets, the bug is real and worth fixing on a normal cycle.

1. Constrain IWA deployment — Limit Isolated Web Apps to approved, allowlisted apps only and review whether the feature is needed at all. For a MEDIUM verdict there is no noisgate mitigation SLA; if you choose to harden, do it opportunistically while heading straight to remediation within 365 days.
2. Block untrusted file delivery paths — Tighten mail and web controls around uncommon browser-app package types and suspicious downloads so the malicious file never reaches users. There is no mitigation SLA for MEDIUM; treat this as hardening that can be batched with your normal browser-control work.
3. Enforce managed Chrome policies — Use enterprise browser policy to restrict app installs, update lag, and risky user-controlled workflows that could process attacker-supplied content. For this MEDIUM assessment, align policy cleanup with the 365-day remediation window rather than treating it as an emergency block.
4. Watch for browser crash and file-open anomalies — Hunt for clusters of Chrome crashes, unusual file-open events, and browser process anomalies on managed ChromeOS or other IWA-relevant populations. This is best deployed as detection engineering during the normal remediation window, since there is no mitigation SLA here.

Run this on the target endpoint or via your endpoint management agent. Invoke it as python3 check_chrome_cve_2026_11102.py with standard user rights; it auto-detects Chrome on Windows, macOS, and Linux and prints VULNERABLE, PATCHED, or UNKNOWN based on whether the installed version is earlier than 149.0.7827.53.

#!/usr/bin/env python3
# check_chrome_cve_2026_11102.py
# Purpose: Check local Google Chrome version against CVE-2026-11102 fixed version.
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import subprocess
import sys

FIXED = (149, 0, 7827, 53)


def parse_version(text):
    if not text:
        return None
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def run_cmd(cmd):
    try:
        p = subprocess.run(cmd, capture_output=True, text=True, timeout=10)
        if p.returncode == 0:
            return (p.stdout or p.stderr).strip()
    except Exception:
        pass
    return None


def get_windows_version():
    cmds = [
        ["reg", "query", r"HKLM\Software\Google\Chrome\BLBeacon", "/v", "version"],
        ["reg", "query", r"HKCU\Software\Google\Chrome\BLBeacon", "/v", "version"],
        ["powershell", "-NoProfile", "-Command", "(Get-ItemProperty 'HKLM:\\Software\\Google\\Chrome\\BLBeacon' -ErrorAction SilentlyContinue).version"],
        ["powershell", "-NoProfile", "-Command", "(Get-ItemProperty 'HKCU:\\Software\\Google\\Chrome\\BLBeacon' -ErrorAction SilentlyContinue).version"]
    ]
    for cmd in cmds:
        out = run_cmd(cmd)
        v = parse_version(out)
        if v:
            return v
    return None


def get_macos_version():
    paths = [
        "/Applications/Google Chrome.app/Contents/Info.plist",
        os.path.expanduser("~/Applications/Google Chrome.app/Contents/Info.plist")
    ]
    for p in paths:
        if os.path.exists(p):
            out = run_cmd(["/usr/bin/defaults", "read", p.replace("/Contents/Info.plist", ""), "CFBundleShortVersionString"])
            v = parse_version(out)
            if v:
                return v
    return None


def get_linux_version():
    bins = [
        "google-chrome",
        "google-chrome-stable",
        "chromium-browser",
        "chromium"
    ]
    for b in bins:
        out = run_cmd([b, "--version"])
        v = parse_version(out)
        if v:
            return v
    return None


def cmp_versions(a, b):
    return (a > b) - (a < b)


def main():
    system = platform.system().lower()
    version = None

    if "windows" in system:
        version = get_windows_version()
    elif "darwin" in system:
        version = get_macos_version()
    elif "linux" in system:
        version = get_linux_version()
    else:
        print("UNKNOWN - Unsupported platform: {}".format(platform.system()))
        sys.exit(2)

    if not version:
        print("UNKNOWN - Could not determine installed Chrome/Chromium version")
        sys.exit(2)

    version_str = ".".join(str(x) for x in version)
    fixed_str = ".".join(str(x) for x in FIXED)

    if cmp_versions(version, FIXED) < 0:
        print("VULNERABLE - Installed version {} is earlier than fixed version {}".format(version_str, fixed_str))
        sys.exit(1)
    else:
        print("PATCHED - Installed version {} is at or newer than fixed version {}".format(version_str, fixed_str))
        sys.exit(0)


if __name__ == "__main__":
    main()

Sources

1. Google Chrome Releases - Stable Channel Update for Desktop (June 2, 2026)
2. Google Chrome Releases - Early Stable Update for Desktop (May 29, 2026)
3. Chrome for Developers - Isolated Web Apps introduction
4. Chrome for Developers - Isolated Web App allowlist
5. Chromium - Launching Isolated Web Apps-specific APIs
6. CISA Known Exploited Vulnerabilities Catalog
7. FIRST EPSS data documentation
8. CIRCL Vulnerability Lookup entry for CVE-2026-11102