Insufficient validation of untrusted input in Skia in Google Chrome prior to 149

CVE-2026-11121 is an input-validation flaw in Chrome's Skia graphics component that affects Google Chrome versions earlier than 149.0.7827.53 on Linux and 149.0.7827.53/.54 on Windows and macOS. Per the published CNA description, the bug lets an attacker who has already compromised the renderer process leak cross-origin data through a crafted HTML page.

Reality check: this is not an initial-access browser RCE, and it is not a sandbox escape. The decisive friction is the prerequisite attacker position: they must already own the renderer, which makes this a second-stage chain component with narrow standalone utility. Google's own Chromium severity label of *Medium* matches the operational reality.

Why this verdict

• Major downward adjustment: requires a compromised renderer first. That implies the attacker is already past the hard part of the browser kill chain.
• Impact is confidentiality only. The published description is cross-origin data leakage, not code execution, privilege escalation, or sandbox escape.
• Exposure is broad but not directly reachable. Chrome is everywhere, but the reachable population for this exact bug is only the subset where an attacker can first land a renderer compromise and then chain successfully.

Why not higher?

It is not a higher-severity issue because it does not provide initial code execution, does not escape the sandbox, and does not require defenders to assume internet-reachable unauthenticated exploitation. The attacker position requirement compounds sharply: internal-to-browser post-compromise plus a data-theft-only outcome is not a patch-everything-now event.

Why not lower?

It is not lower because cross-origin data leakage inside a live enterprise browser session can still expose SSO-backed application data, tokens, and sensitive content. Chrome is widely deployed, and post-renderer chain components matter when paired with other browser bugs or malicious extensions.

1. Enforce extension allowlisting — Reduce one of the realistic renderer-compromise on-ramps by blocking unapproved extensions and auditing sideloading. For a MEDIUM verdict there is no mitigation SLA — go straight to the 365-day remediation window, so do this in your normal browser-hardening cycle rather than as an emergency action.
2. Prioritize risky user cohorts — Move admins, developers, finance, and high-travel users to the fixed Chrome build first because they are the most likely to combine browser exposure with valuable authenticated SaaS sessions. Again, no mitigation SLA — go straight to the 365-day remediation window, but use risk-based rings to close the gap faster.
3. Watch for browser-to-identity pivoting — Tune detections for suspicious token reuse, abnormal SaaS access, and browser-driven child-process anomalies, because the likely enterprise pain is session theft after a chained exploit. For MEDIUM, treat this as monitoring hardening during the remediation campaign, not a stop-the-line control.

Run this on the target endpoint or through your EDR live-response/remote script runner. Invoke it with python3 check_cve_2026_11121.py on macOS/Linux or py check_cve_2026_11121.py on Windows; no admin rights are usually required, but the script needs permission to read common install paths and execute the browser binary with --version.

#!/usr/bin/env python3
# check_cve_2026_11121.py
# Determine whether installed Chrome/Chromium builds are vulnerable to CVE-2026-11121.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import shutil
import subprocess
import sys
from pathlib import Path

FIXED = (149, 0, 7827, 53)

CANDIDATES = {
    'Windows': [
        r'C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe',
        r'C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe',
        r'C:\\Users\\%USERNAME%\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe',
        r'C:\\Program Files\\Chromium\\Application\\chrome.exe',
        r'C:\\Program Files (x86)\\Chromium\\Application\\chrome.exe'
    ],
    'Darwin': [
        '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
        str(Path.home() / 'Applications/Google Chrome.app/Contents/MacOS/Google Chrome'),
        '/Applications/Chromium.app/Contents/MacOS/Chromium'
    ],
    'Linux': [
        '/usr/bin/google-chrome',
        '/usr/bin/google-chrome-stable',
        '/opt/google/chrome/chrome',
        '/usr/bin/chromium',
        '/usr/bin/chromium-browser',
        '/snap/bin/chromium'
    ]
}

EXE_FALLBACKS = ['google-chrome', 'google-chrome-stable', 'chromium', 'chromium-browser', 'chrome']


def parse_version(text):
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def version_lt(a, b):
    return a < b


def expand_win(path):
    return os.path.expandvars(path.replace('%USERNAME%', os.environ.get('USERNAME', '')))


def collect_paths():
    system = platform.system()
    paths = []
    for p in CANDIDATES.get(system, []):
        paths.append(expand_win(p) if system == 'Windows' else p)
    for name in EXE_FALLBACKS:
        resolved = shutil.which(name)
        if resolved:
            paths.append(resolved)
    seen = []
    for p in paths:
        if p and p not in seen:
            seen.append(p)
    return seen


def get_version(binary):
    try:
        proc = subprocess.run([binary, '--version'], capture_output=True, text=True, timeout=8)
        output = (proc.stdout or '') + ' ' + (proc.stderr or '')
        return parse_version(output)
    except Exception:
        return None


def main():
    found = []
    vulnerable = []
    patched = []

    for path in collect_paths():
        if os.path.isfile(path) or shutil.which(path):
            ver = get_version(path)
            if ver:
                found.append((path, ver))
                if version_lt(ver, FIXED):
                    vulnerable.append((path, ver))
                else:
                    patched.append((path, ver))

    if vulnerable:
        print('VULNERABLE')
        for path, ver in vulnerable:
            print(f'{path} -> {".".join(map(str, ver))} < {".".join(map(str, FIXED))}')
        sys.exit(1)

    if patched:
        print('PATCHED')
        for path, ver in patched:
            print(f'{path} -> {".".join(map(str, ver))}')
        sys.exit(0)

    print('UNKNOWN')
    print('No runnable Chrome/Chromium binary found in common locations, or version parsing failed.')
    sys.exit(2)


if __name__ == '__main__':
    main()

Sources

1. Google Chrome stable desktop release 149
2. Google Chrome early stable desktop release 149.0.7827.53/.54
3. Vulnerability Lookup entry/search result containing CVE-2026-11121 CNA text
4. CISA Known Exploited Vulnerabilities Catalog
5. FIRST EPSS data and field definitions
6. Chromium security page