Uninitialized Use in ANGLE in Google Chrome prior to 149

CVE-2026-11109 is an *uninitialized use* bug in Chrome's ANGLE graphics layer. In practice, a malicious site can drive the browser into a state where memory that should have been safely initialized is not, and the result is *cross-origin data leakage* from a crafted HTML page. The affected range is Chrome versions *before* 149.0.7827.53 on desktop; Google's June 2026 stable release is the fix point.

Google's MEDIUM 6.5 rating is basically fair, and if anything slightly generous for enterprise patch triage. The amplifier is that Chrome is everywhere and browsing untrusted HTML is normal business behavior; the brakes are that this is *not* RCE, *not* a sandbox escape, needs user interaction, and there is no KEV listing or strong exploitation telemetry pushing it into urgent territory.

Why this verdict

• Downgrade for impact shape: the published impact is *confidentiality only*; there is no stated code execution, sandbox escape, integrity loss, or availability loss.
• Downward pressure from attacker workflow: the first prerequisite is *user interaction* on a crafted page. That implies phishing, malvertising, or site compromise rather than direct unauthenticated reachability to a service.
• Downward pressure from exploit reliability: the ANGLE/graphics path and the linked fix suggest backend/state-dependent behavior, which is usually less clean to weaponize than a deterministic parser bug.
• Not lower because exposure population is huge: Chrome is ubiquitous in enterprise, and visiting arbitrary web content is normal. Even with UI:R, the reachable population is broad once a lure lands.
• Not higher because external evidence is weak: no KEV listing, no public PoC found, and the supplied EPSS is very low.

Why not higher?

There is no evidence here of host compromise, sandbox escape, or remote code execution. If this were paired with active exploitation evidence, a reliable public PoC, or demonstrated credential/session theft at scale, the score would move up fast.

Why not lower?

A browser-origin leak is still meaningful because the browser is where your workforce lives: email, SSO, HR, finance, ticketing, and admin panels all sit behind it. The fact that a normal web page can trigger the vulnerable path means this is not mere lab trivia.

1. Enforce Chrome auto-update and relaunch — Use enterprise policy or your software delivery stack to make sure Chrome actually advances past 149.0.7827.53 and users restart into the new build. For a MEDIUM verdict there is *no mitigation SLA* under noisgate, so this is primarily an operational control to accelerate remediation rather than a separate emergency measure.
2. Turn on browser version telemetry — Collect browser version data from managed endpoints so you can identify stragglers by OU, business unit, or VDI pool. This matters because client-side browser risk is about fleet coverage, not perimeter exposure.
3. Reduce exposure to untrusted web content — Use secure web gateway, DNS filtering, and Safe Browsing-aligned controls to cut off initial lure traffic and malicious landing pages. This does not fix the bug, but it lowers the chance the crafted HTML ever executes while the patch rollout completes.
4. Constrain risky browser features where business-tolerable — For high-risk populations such as admins, finance, and researchers, consider temporary hardening of graphics-heavy or untrusted browsing scenarios if your environment can tolerate it. This is a targeted risk-reduction move, not a substitute for upgrading the browser.

Run this on the *target endpoint* or through your endpoint management agent. Invoke it with python3 check_chrome_cve_2026_11109.py on macOS/Linux or py check_chrome_cve_2026_11109.py on Windows; standard user rights are usually enough, though some Windows registry paths may be easier with local read access.

#!/usr/bin/env python3
# check_chrome_cve_2026_11109.py
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN / could not determine

import os
import platform
import re
import subprocess
import sys

THRESHOLD = (149, 0, 7827, 53)


def parse_version(text):
    if not text:
        return None
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def run_cmd(cmd):
    try:
        p = subprocess.run(cmd, capture_output=True, text=True, timeout=10)
        out = (p.stdout or '') + '\n' + (p.stderr or '')
        return out.strip()
    except Exception:
        return ''


def get_windows_version():
    candidates = [
        ["reg", "query", r"HKLM\Software\Google\Chrome\BLBeacon", "/v", "version"],
        ["reg", "query", r"HKLM\Software\WOW6432Node\Google\Chrome\BLBeacon", "/v", "version"],
        ["powershell", "-NoProfile", "-Command", r"(Get-ItemProperty 'HKLM:\Software\Google\Chrome\BLBeacon' -ErrorAction SilentlyContinue).version"],
        ["powershell", "-NoProfile", "-Command", r"(Get-ItemProperty 'HKLM:\Software\WOW6432Node\Google\Chrome\BLBeacon' -ErrorAction SilentlyContinue).version"],
        [r"C:\Program Files\Google\Chrome\Application\chrome.exe", "--version"],
        [r"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe", "--version"],
    ]
    for cmd in candidates:
        out = run_cmd(cmd)
        ver = parse_version(out)
        if ver:
            return ver, out
    return None, ''


def get_macos_version():
    candidates = [
        ["/Applications/Google Chrome.app/Contents/MacOS/Google Chrome", "--version"],
        ["/Applications/Google Chrome.app/Contents/Info.plist"],
        ["defaults", "read", "/Applications/Google Chrome.app/Contents/Info", "CFBundleShortVersionString"],
        ["mdls", "-name", "kMDItemVersion", "/Applications/Google Chrome.app"],
    ]
    for cmd in candidates:
        if len(cmd) == 1 and cmd[0].endswith('.plist'):
            continue
        out = run_cmd(cmd)
        ver = parse_version(out)
        if ver:
            return ver, out
    return None, ''


def get_linux_version():
    candidates = [
        ["google-chrome", "--version"],
        ["google-chrome-stable", "--version"],
        ["chromium-browser", "--version"],
        ["chromium", "--version"],
        ["/opt/google/chrome/chrome", "--version"],
    ]
    for cmd in candidates:
        out = run_cmd(cmd)
        ver = parse_version(out)
        if ver:
            return ver, out
    return None, ''


def compare_versions(a, b):
    return (a > b) - (a < b)


def main():
    system = platform.system().lower()

    if 'windows' in system:
        ver, source = get_windows_version()
    elif 'darwin' in system:
        ver, source = get_macos_version()
    elif 'linux' in system:
        ver, source = get_linux_version()
    else:
        print('UNKNOWN: unsupported OS {}'.format(platform.system()))
        sys.exit(2)

    if not ver:
        print('UNKNOWN: could not determine installed Chrome/Chromium version')
        sys.exit(2)

    ver_str = '.'.join(str(x) for x in ver)
    if compare_versions(ver, THRESHOLD) < 0:
        print('VULNERABLE: detected version {} which is earlier than {}'.format(ver_str, '.'.join(map(str, THRESHOLD))))
        sys.exit(1)
    else:
        print('PATCHED: detected version {} which is at or later than {}'.format(ver_str, '.'.join(map(str, THRESHOLD))))
        sys.exit(0)


if __name__ == '__main__':
    main()

Sources

1. Google Chrome Releases - Stable Channel Update for Desktop
2. Chromium issue tracker - issue 500524833
3. ANGLE commit linked to bug 500524833
4. Vulnerability-Lookup search results including CVE-2026-11109
5. CISA Known Exploited Vulnerabilities Catalog
6. Chrome Enterprise - Report OS and Google Chrome Version Information
7. Chrome Enterprise - User Security Signals Reporting
8. Shodan Internet Exposure Dashboard