01 · The Real Story
Someone repainted the elevator buttons but the elevator still goes to the same floors
CVE-2026-11107 is an inappropriate implementation in the Downloads component of Google Chrome on all desktop platforms (Windows, macOS, Linux) prior to version 149.0.7827.53. The flaw allows a remote attacker to craft an HTML page that visually spoofs the browser's download bar or download-related UI elements (CWE-451: User Interface Misrepresentation of Critical Information). The attack requires user interaction — the victim must navigate to a malicious page. Impact is confined to low-severity integrity loss (I:L); there is no confidentiality breach, no availability impact, no sandbox escape, and no code execution. The bug was disclosed on 2026-06-04 as part of the massive Chrome 149 release that patched a record 429 vulnerabilities.
Google's own Chromium severity rating of Medium is already generous for a UI-cosmetic bug that cannot execute code. The CVSS 3.1 base score of 4.3 faithfully reflects the vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N), but it does not account for Chrome's aggressive auto-update cycle, the absence of any exploitation evidence, and the reality that this bug's incremental risk over plain social engineering is negligible. A defender running any modern browser management policy already has this patched on >95% of endpoints by now — nearly four months after disclosure.
"Chrome download-bar cosmetic spoof with no code exec; auto-update already fixed most fleets."
02 · The Attack Path
4 steps from start to impact.
STEP 01
Attacker hosts malicious page
The attacker creates a crafted HTML page designed to abuse the inappropriate implementation in Chrome's download UI. The page is hosted on attacker-controlled infrastructure or injected via a compromised ad network. No special server-side components are required — standard HTML/CSS/JS suffices.
Conditions required:
- Attacker controls or can inject content into a web page reachable by the victim
Where this breaks in practice:
- Page must survive Safe Browsing and URL reputation checks
- Enterprise web proxies with URL categorization may block unknown or newly registered domains
Detection/coverage: Google Safe Browsing flags known malicious URLs. Enterprise proxy logs and DNS RPZ policies provide visibility.
STEP 02
Victim navigates to crafted page
The victim must be socially engineered into visiting the attacker's page — via phishing email, malicious ad, or watering-hole compromise. The CVSS vector specifies
UI:R (User Required). Without this click, the chain is dead.Conditions required:
- Victim uses an unpatched Chrome version (< 149.0.7827.53)
- Victim clicks a link or is redirected to the malicious page
Where this breaks in practice:
- Chrome auto-update means the vulnerable window is narrow — typically < 72 hours for managed fleets
- Email security gateways strip or sandbox suspicious links
- Security-aware users may not click
Detection/coverage: Email gateway link-click telemetry, proxy request logs, and Chrome enterprise reporting connector all provide signals.
STEP 03
Download UI is spoofed
The crafted page triggers the inappropriate implementation, causing Chrome to render a download bar or download prompt that misrepresents the source, type, or safety status of a file. The user sees UI elements that look legitimate but are attacker-controlled. This is a visual deception only — no code runs, no sandbox escapes.
Conditions required:
- Victim's Chrome is unpatched
- Page successfully renders the spoofed UI
Where this breaks in practice:
- Chrome's built-in download protections (Safe Browsing file checks, dangerous-file warnings) still operate independently of the UI spoof
- SmartScreen or endpoint AV will scan the downloaded file regardless of how the UI appeared
- The spoof affects cosmetics, not the actual download pipeline
Detection/coverage: Endpoint Detection and Response (EDR) monitors file-write events from browser processes regardless of UI state. Download audit logs in Chrome enterprise policy capture the actual URL and file hash.
STEP 04
User acts on spoofed prompt
The victim must be convinced by the spoofed UI to download and execute a malicious file, accept a malicious extension install, or otherwise take an action they would not have taken with accurate UI. This is functionally equivalent to a social engineering attack with a slightly more convincing wrapper.
Conditions required:
- User trusts the spoofed UI enough to execute the downloaded payload
- Downloaded payload is not blocked by endpoint AV, EDR, or application control
Where this breaks in practice:
- Modern EDR and AV scan all downloaded executables before and during execution
- Application control policies (AppLocker, WDAC) block unsigned or untrusted binaries
- Mark-of-the-Web (MOTW) triggers additional SmartScreen warnings on downloaded files
- The incremental persuasion advantage over a standard phishing lure is marginal
Detection/coverage: EDR process-creation telemetry, AV real-time scanning, MOTW-triggered SmartScreen alerts, and application control block events all fire at this stage.
03 · Compensating Control
1
LOW 3.0→IGNORE 0.0
SEVERITY REDUCEDVerify Chrome auto-update is functioning fleet-wide — Run a fleet-wide query via your browser management tool (Chrome Enterprise CBCM, Intune, SCCM, osquery) to confirm all Chrome installs are >= 149.0.7827.53. Any host still below this version 118 days post-release has a broken update pipeline that affects far more than this one CVE. This is a hygiene check, not an emergency action. No mitigation SLA applies for LOW severity — treat as backlog hygiene.
2
LOW 3.0→IGNORE 0.0
SEVERITY REDUCEDEnforce application control policies (AppLocker / WDAC / Santa) — Application control prevents execution of unsigned or untrusted binaries regardless of how the user was convinced to download them. This breaks step 4 of the attack path entirely. If you already have application control enforced in block mode, the residual risk from this CVE is effectively zero.
3
LOW 3.0→IGNORE 0.0
SEVERITY REDUCEDEnable Chrome Safe Browsing Enhanced Protection via enterprise policy — Set
SafeBrowsingProtectionLevel to 2 (Enhanced) via Group Policy or Chrome ADMX. Enhanced Safe Browsing provides real-time URL and download checks against Google's threat intelligence, catching malicious pages before the UI spoof even renders. This breaks step 1-2 of the attack path for known-bad infrastructure.4
LOW 3.0→IGNORE 0.0
SEVERITY REDUCEDDeploy download-content inspection at the web proxy — Enterprise proxies (Zscaler, Netskope, Palo Prisma) that inspect downloaded content and apply file-type policies will block malicious payloads regardless of how the Chrome UI represents them. This breaks step 4 independently of the endpoint.
What doesn't work
- Network segmentation — irrelevant. This is a client-side browser bug triggered by visiting a web page. Network segmentation does not prevent a user from browsing to an attacker-controlled URL.
- WAF rules — irrelevant. The vulnerability is in the browser client, not a web server. A WAF protects inbound traffic to your servers, not outbound browsing from your endpoints.
- MFA — irrelevant. No authentication bypass is involved. The bug spoofs download UI, not login prompts. MFA does not interact with this attack chain at any step.
04 · Intelligence Metadata
The supporting signals.
| In-the-Wild Exploitation | None observed. Not listed in CISA KEV. No reports from Google TAG, Mandiant, or any threat intelligence vendor indicate exploitation. No GreyNoise or Shodan signals — expected, since this is a client-side browser bug, not a remotely scannable service. |
|---|---|
| Proof-of-Concept Availability | No public PoC found. Checked pocindex.io (no entry), GitHub (no repos named CVE-2026-11107), ExploitDB, and Nuclei templates. The SecureWithUmer/CVE-2026-PoCs community collection does not include this CVE. Given the low impact (UI cosmetic only), researcher interest is minimal. |
| EPSS Score | 0.00227 (0.227% probability of exploitation in next 30 days). This places it roughly in the 75th–80th percentile — meaning ~20–25% of all CVEs have a higher exploitation probability. Very low urgency signal. |
| CISA KEV Status | Not listed. No known exploited vulnerability entry. No federal BOD deadline applies. |
| CVSS Vector Interpretation | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N — Network-reachable, low complexity, no privileges needed, but requires user interaction. Scope is unchanged (no sandbox escape). Impact is integrity-low only — no confidentiality or availability loss. This is the textbook profile of a UI spoofing bug. |
| Affected Versions | Google Chrome < 149.0.7827.53 (Linux) and < 149.0.7827.54 (Windows, macOS). All desktop platforms affected. Chromium-based browsers (Edge, Brave, Opera, Vivaldi) may be affected if they haven't merged the upstream fix. |
| Fixed Versions | Chrome 149.0.7827.53+ (Linux), 149.0.7827.54+ (Windows/macOS). Released 2026-06-04. Chromium-based Edge typically follows within 1–2 weeks. Debian/Ubuntu track chromium-browser package; RHEL/Fedora via Flatpak or snap. |
| Patch Deployment Window | Chrome auto-updates within 24–72 hours for consumer installs and managed fleets with default update policies. As of today (2026-09-30), the fix has been available for ~118 days. Any host still running Chrome < 149 has deeper fleet-management problems. |
| Disclosure Context | Part of the record-breaking Chrome 149 release that patched 429 vulnerabilities — 22 critical, 100+ high. This CVE was one of many medium/low-severity UI bugs in that batch. Reported by Google's internal tooling (likely AI-assisted fuzzing via Big Sleep). |
| Researcher / Reporter | Not publicly attributed to an external researcher. Likely discovered internally by Google's automated security tooling, consistent with the 371 internally-found bugs in the Chrome 149 batch. |
Sources.
05 · The Call
Final Verdict
↓ DOWNGRADED to LOW (3.0/10)
Why this verdict
- No code execution path: This is a UI cosmetic spoof (CWE-451) with
I:Las the sole impact metric. There is no confidentiality breach, no availability impact, no sandbox escape, and no privilege escalation. The attacker gains a slightly prettier phishing lure — nothing more. - User interaction is a hard gate: The
UI:Rrequirement means the entire chain depends on social engineering. The incremental persuasion advantage of a spoofed download bar over a standard phishing page is marginal at best. Every step beyond the spoof (download, execute, bypass AV) faces independent friction from existing endpoint controls. - Chrome auto-update eliminates the vulnerable population: Chrome's aggressive auto-update cycle means >95% of managed fleets patched within 72 hours of the 2026-06-04 release. We are now 118 days post-disclosure. Any remaining vulnerable hosts indicate a broken update pipeline, not a patching decision.
- Zero exploitation signals: No KEV listing, no in-the-wild exploitation, no public PoC, EPSS at 0.227%. The threat intelligence community has shown zero interest in weaponizing this bug — rationally, because social engineering already works without it.
- Role multiplier: Chrome is a user-facing browser that runs on workstations (low-value role) and admin workstations (potentially high-value role). However, even on an admin workstation used to manage domain controllers or hypervisors, this bug does not grant code execution, credential theft, or lateral movement. The blast radius is limited to one user's visual perception of a download prompt. The chain requires the admin to then download and execute a malicious file, which faces EDR, AV, MOTW, AppLocker, and WDAC friction independently. No high-value-role scenario produces domain takeover, fleet compromise, or supply-chain impact from this UI spoof alone. The high-value-role floor does NOT apply because the bug's terminal impact (visual deception) cannot scale beyond the individual session regardless of the host's role.
Why not higher?
A MEDIUM rating would be justified only if the UI spoof could reliably bypass download-safety mechanisms (Safe Browsing, MOTW, SmartScreen) or if there were evidence of active exploitation making the social-engineering chain more practical. Neither condition exists. The bug does not disable any security control — it only changes what the user sees in the download bar. Every downstream defense (AV, EDR, application control) still functions normally.
Why not lower?
An IGNORE rating would require that the bug has literally no security relevance. While the incremental risk is small, the bug does make social engineering marginally easier by allowing the attacker to misrepresent download metadata in the browser UI. In an environment with no EDR, no application control, and untrained users, this could be the difference between a clicked lure and a dismissed one. The network attack vector without authentication also means it is technically reachable. LOW is the appropriate floor.
06 · Verification
Crowdsourced verification payload.
Run on any auditor workstation or CI runner with Python 3.6+. No special privileges needed. Pass the target Chrome version string as an argument: python check_cve_2026_11107.py 149.0.7827.52. For fleet-wide checks, pipe version strings from osquery (SELECT version FROM chrome_extensions LIMIT 1) or CBCM export.
#!/usr/bin/env python3
"""CVE-2026-11107 version checker.
Checks if a given Chrome version is vulnerable to the Downloads UI spoofing bug.
Fixed in: 149.0.7827.53 (Linux), 149.0.7827.54 (Windows/macOS)
Usage: python check_cve_2026_11107.py <chrome_version> [--platform linux|windows|macos]
Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN
"""
import sys
import argparse
def parse_version(v):
"""Parse Chrome version string into tuple of ints."""
try:
parts = v.strip().split('.')
return tuple(int(p) for p in parts)
except (ValueError, AttributeError):
return None
def main():
parser = argparse.ArgumentParser(description='Check CVE-2026-11107 vulnerability status')
parser.add_argument('version', help='Chrome version string, e.g. 149.0.7827.52')
parser.add_argument('--platform', choices=['linux', 'windows', 'macos'], default='linux',
help='Target platform (default: linux)')
args = parser.parse_args()
ver = parse_version(args.version)
if ver is None:
print(f'UNKNOWN - Could not parse version: {args.version}')
sys.exit(2)
# Fixed versions per platform
if args.platform == 'linux':
fixed = (149, 0, 7827, 53)
else: # windows or macos
fixed = (149, 0, 7827, 54)
if ver >= fixed:
print(f'PATCHED - Chrome {args.version} ({args.platform}) >= {".".join(str(x) for x in fixed)}')
sys.exit(0)
else:
print(f'VULNERABLE - Chrome {args.version} ({args.platform}) < {".".join(str(x) for x in fixed)}')
print(f' CVE-2026-11107: Inappropriate implementation in Downloads (UI Spoofing)')
print(f' Action: Update Chrome to >= {".".join(str(x) for x in fixed)}')
sys.exit(1)
if __name__ == '__main__':
main()