Use after free in Device Trust in Google Chrome on Mac prior to 149

CVE-2026-11114 is a use-after-free in Chrome Device Trust on macOS affecting Google Chrome versions before 149.0.7827.53. The public description is important: the attacker must already have compromised the renderer process and then use a crafted HTML page to try to turn that foothold into a sandbox escape. Device Trust itself is an enterprise/browser-management feature used to surface device signals for managed Chrome deployments.

The vendor-style CRITICAL 9.6 framing overshoots reality for enterprise patch triage. In real deployments this is not an initial-access bug; it is a second-stage exploit primitive that only matters after a separate renderer exploit lands, and it is further narrowed by being Mac-only and *likely* most relevant where Device Trust is actually deployed on managed browsers. That combination pushes this down from emergency patch-now territory into meaningful but not fleet-panic risk.

Why this verdict

• Major downward adjustment: requires prior renderer compromise — attacker position is effectively *already inside the browser sandbox*, which implies a separate exploit chain has already succeeded
• Further downward adjustment: Mac-only — this immediately removes Windows and Linux endpoints from scope
• Likely narrower enterprise population — Device Trust is an admin-configured managed-browser feature, so the affected blast radius is probably smaller than generic Chrome memory corruption bugs
• No current exploitation amplifier — not KEV-listed, no public PoC, and supplied EPSS is extremely low
• Why it stays MEDIUM — a successful sandbox escape from a compromised renderer is still a meaningful security boundary break on a heavily deployed browser

Why not higher?

If this were a direct unauthenticated renderer RCE or if there were active exploitation / KEV evidence, the verdict would jump. But this CVE is explicitly a second-stage sandbox escape and depends on the attacker first solving a different exploit problem, which is strong real-world friction.

Why not lower?

This is still a security boundary bypass in Chrome on macOS, not harmless hygiene. If an adversary already has renderer compromise, this bug can help turn a contained browser foothold into broader endpoint impact, so dismissing it as LOW or IGNORE would understate what it contributes to a chained attack.

1. Force Chrome auto-update on managed Macs — Use your browser management stack to make sure macOS Chrome moves to 149.0.7827.53+. Because this is a MEDIUM verdict there is no noisgate mitigation SLA; treat this as normal patch governance and complete remediation within the 365-day window.
2. Inventory Device Trust-enabled browser populations — Identify which managed macOS browsers or managed profiles actually have Device Trust connectors/policies enabled, because that is the most plausible narrowed exposure set. There is no mitigation SLA for MEDIUM, so do this as part of scoped remediation planning inside the 365-day remediation window.
3. Prioritize risky user groups first — Even without a formal mitigation SLA, move admins, developers, security staff, and executives on Macs to the front of the browser update ring because they are more likely to browse risky content and more costly to compromise. That is a practical sequencing step while staying inside the 365-day remediation window.
4. Keep EDR and browser telemetry tuned for crash-to-child-process patterns — You are unlikely to detect this specific CVE pre-exploitation, but chained browser exploitation often leaves renderer instability, suspicious spawned processes, or post-browser payload behavior. There is no mitigation SLA for MEDIUM; use this as a detection hardening measure while patching normally.

Run this on the target macOS endpoint or via your Mac management agent. Invoke it as bash check_cve_2026_11114.sh "/Applications/Google Chrome.app"; it needs no root privileges and checks the installed Chrome version against the fixed build 149.0.7827.53.

#!/bin/bash
# check_cve_2026_11114.sh
# Checks whether Google Chrome on macOS is below the fixed version for CVE-2026-11114.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

TARGET_APP="${1:-/Applications/Google Chrome.app}"
PLIST="$TARGET_APP/Contents/Info.plist"
FIXED_VERSION="149.0.7827.53"

version_ge() {
  local a b i max
  IFS='.' read -r -a a <<< "$1"
  IFS='.' read -r -a b <<< "$2"
  if [ "${#a[@]}" -gt "${#b[@]}" ]; then
    max="${#a[@]}"
  else
    max="${#b[@]}"
  fi
  for ((i=0; i<max; i++)); do
    local ai="${a[i]:-0}"
    local bi="${b[i]:-0}"
    if ((10#$ai > 10#$bi)); then
      return 0
    elif ((10#$ai < 10#$bi)); then
      return 1
    fi
  done
  return 0
}

if [ "$(uname -s)" != "Darwin" ]; then
  echo "UNKNOWN: This script must be run on macOS."
  exit 2
fi

if [ ! -f "$PLIST" ]; then
  echo "UNKNOWN: Chrome Info.plist not found at $PLIST"
  exit 2
fi

if ! command -v /usr/libexec/PlistBuddy >/dev/null 2>&1; then
  echo "UNKNOWN: /usr/libexec/PlistBuddy not available"
  exit 2
fi

INSTALLED_VERSION="$(/usr/libexec/PlistBuddy -c 'Print :CFBundleShortVersionString' "$PLIST" 2>/dev/null || true)"

if [ -z "$INSTALLED_VERSION" ]; then
  echo "UNKNOWN: Could not read Chrome version from $PLIST"
  exit 2
fi

if version_ge "$INSTALLED_VERSION" "$FIXED_VERSION"; then
  echo "PATCHED: Google Chrome $INSTALLED_VERSION at $TARGET_APP"
  exit 0
else
  echo "VULNERABLE: Google Chrome $INSTALLED_VERSION at $TARGET_APP"
  exit 1
fi

Sources

1. NVD CVE-2026-11114
2. Chrome Stable Channel Update for Desktop - June 2, 2026
3. Chrome Early Stable Update for Desktop - May 29, 2026
4. Chromium issue 501360342
5. Manage Chrome Enterprise device trust connectors
6. Chromium process models
7. CISA Known Exploited Vulnerabilities Catalog
8. FIRST EPSS Data and Statistics