Insufficient validation of untrusted input in WebUI in Google Chrome prior to 149

CVE-2026-11105 is an *improper input validation* flaw in Chrome WebUI that can leak cross-origin data, but only after the attacker has already compromised the renderer process. Based on Google's release notes and CVE metadata, the affected population is desktop Chrome on Windows, macOS, and Linux before the fixed 149.0.7827.53 line (Windows/macOS shipping as 149.0.7827.53/54, Linux as 149.0.7827.53). This is not a clean unauthenticated remote browser pop by itself; it is a post-compromise boundary bypass inside the browser architecture.

Google's MEDIUM label is fair in lab conditions, but for enterprise patch triage the real-world urgency is lower. The decisive friction is the prerequisite: *the attacker must already own the renderer process*. That means this bug is mostly valuable as the second stage of a broader exploit chain, not as an initial foothold, and there is no KEV listing, no public exploitation signal, and no public weaponized PoC to justify pulling focus from remotely reachable first-hop bugs.

Why this verdict

• Major prerequisite drag: the attacker must already have compromised the renderer process, which implies a prior exploit stage or malicious extension foothold before this CVE contributes anything.
• Exposure population collapses after stage one: while Chrome is everywhere, the subset of enterprise browsers with a working renderer compromise in play is tiny compared with remotely reachable server bugs.
• Impact is scoped to confidentiality: the described outcome is cross-origin data leakage, not direct endpoint code execution, domain-wide blast radius, or service interruption.
• Modern controls should stop earlier steps: extension allowlisting, browser hardening, EDR, and web filtering are more likely to break the chain before the WebUI flaw is exercised.
• Threat intel is cold: no KEV listing, no public exploitation signal, and a very low EPSS all argue against emergency prioritization.

Why not higher?

To justify HIGH, this would need either first-hop exploitability, broad active exploitation, or unusually low-friction chaining. We have the opposite: a chained, post-renderer-compromise confidentiality bug with restricted details and no public exploitation evidence. That is not the profile of a fleet-wide interrupt-driven patch event.

Why not lower?

It is still a real browser boundary failure in a massively deployed product, and successful chaining can expose authenticated cross-origin data from enterprise users. Once a renderer is compromised, the browser profile can contain high-value SaaS, SSO, and internal-app data, so dismissing it entirely would be sloppy.

1. Enforce Chrome auto-update — Make sure endpoints are actually receiving Chrome 149+ and not stuck on frozen channels or broken update services. For a LOW verdict there is no SLA (treat as backlog hygiene), so handle this in the normal browser evergreen cycle rather than as an emergency outage event.
2. Tighten extension allowlisting — Because this CVE only matters after renderer compromise or equivalent browser foothold, reducing untrusted extension execution removes one of the most realistic enterprise chain starters. Keep this in place as ongoing hygiene; there is no mitigation SLA for LOW beyond normal control maintenance.
3. Preserve browser process telemetry — Retain EDR/browser telemetry around unusual renderer crashes, unexpected internal-page access, and suspicious Chrome child-process behavior. This helps you catch the *first* stage of the chain, which is the part that actually determines risk.
4. Prioritize shared-admin and privileged-user fleets — If you must sequence rollout, hit admin workstations, developers, and users with persistent access to internal apps first because those profiles carry the highest-value cross-origin data. Still treat it as normal patch hygiene, not a special crisis action.

Run this on the target endpoint or through your endpoint management tooling. Invoke it with python3 chrome_cve_2026_11105_check.py (or python chrome_cve_2026_11105_check.py on Windows); no admin rights are required if the script can execute the local Chrome binary with --version.

#!/usr/bin/env python3
# CVE-2026-11105 Chrome version check
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import shutil
import subprocess
import sys

FIXED_VERSION = (149, 0, 7827, 53)

WINDOWS_PATHS = [
    r"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe",
    r"C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe",
    os.path.expandvars(r"%LOCALAPPDATA%\\Google\\Chrome\\Application\\chrome.exe"),
]

MAC_PATHS = [
    "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome",
    os.path.expanduser("~/Applications/Google Chrome.app/Contents/MacOS/Google Chrome"),
]

LINUX_CANDIDATES = [
    "google-chrome",
    "google-chrome-stable",
    "chromium-browser",
    "chromium",
    "/opt/google/chrome/chrome",
]


def parse_version(text):
    m = re.search(r"(\d+)\.(\d+)\.(\d+)\.(\d+)", text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def run_version_command(path):
    try:
        result = subprocess.run([path, "--version"], capture_output=True, text=True, timeout=10)
        output = (result.stdout or "") + " " + (result.stderr or "")
        return output.strip()
    except Exception:
        return None


def find_chrome_binary():
    system = platform.system().lower()

    if system == "windows":
        for p in WINDOWS_PATHS:
            if p and os.path.exists(p):
                return p
        where = shutil.which("chrome") or shutil.which("chrome.exe")
        if where:
            return where

    elif system == "darwin":
        for p in MAC_PATHS:
            if os.path.exists(p):
                return p
        where = shutil.which("google-chrome")
        if where:
            return where

    else:
        for candidate in LINUX_CANDIDATES:
            if candidate.startswith("/") and os.path.exists(candidate):
                return candidate
            where = shutil.which(candidate)
            if where:
                return where

    return None


def compare_versions(found, fixed):
    if found < fixed:
        return -1
    if found > fixed:
        return 1
    return 0


def main():
    chrome = find_chrome_binary()
    if not chrome:
        print("UNKNOWN - Chrome binary not found")
        sys.exit(2)

    output = run_version_command(chrome)
    if not output:
        print(f"UNKNOWN - Failed to execute version check for: {chrome}")
        sys.exit(2)

    version = parse_version(output)
    if not version:
        print(f"UNKNOWN - Could not parse Chrome version from output: {output}")
        sys.exit(2)

    cmp_result = compare_versions(version, FIXED_VERSION)
    version_str = ".".join(str(x) for x in version)

    if cmp_result < 0:
        print(f"VULNERABLE - Detected Chrome {version_str} at {chrome}; fixed version is {'.'.join(str(x) for x in FIXED_VERSION)} or later")
        sys.exit(1)
    else:
        print(f"PATCHED - Detected Chrome {version_str} at {chrome}; meets or exceeds fixed version {'.'.join(str(x) for x in FIXED_VERSION)}")
        sys.exit(0)


if __name__ == "__main__":
    main()

Sources

1. Chrome stable desktop release 149.0.7827.53/54
2. Chrome early stable desktop release 149.0.7827.53/54
3. Chromium issue 500505339
4. CVE record
5. Chrome security page
6. FIRST EPSS API
7. CISA KEV catalog