Inappropriate implementation in Keyboard in Google Chrome prior to 149

CVE-2026-11122 is a Chrome UXSS flaw in the Keyboard component. In plain English: a malicious web page can make Chrome treat attacker-controlled script or HTML as more trusted than it should, letting the attacker run content across origin boundaries inside the browser. Affected builds are Google Chrome prior to 149.0.7827.53; Google’s desktop stable release on June 2, 2026 shipped 149.0.7827.53 for Linux and 149.0.7827.53/.54 for Windows and macOS.

Google tagged it Medium, and technically that is defensible because the published impact is script/HTML injection (UXSS) rather than sandbox escape or native code execution. But for enterprise defenders, that underrates the operational risk: this is a remote, drive-by, browser-reachable bug in one of the most ubiquitous apps in the fleet, and UXSS can turn active browser sessions into stolen data, stolen tokens, and cross-origin abuse without needing internal access or local execution. That pushes it above ordinary medium backlog material, even without evidence of active exploitation.

Why this verdict

• Upward pressure: unauthenticated remote drive-by. The attacker position is just “can get a user to render a crafted page,” which is internet-scale and does not assume prior compromise, internal access, or valid credentials.
• Upward pressure: Chrome is everywhere. This is not a niche appliance; reachable population is whatever share of your fleet runs Chrome and has not yet updated, so exposure can be very broad even though there is no server-side listening surface.
• Downward pressure: impact is browser-context UXSS, not host takeover. The CVE describes arbitrary script/HTML injection and cross-origin abuse, which is serious for sessions and data, but it is still a step below sandbox escape or native RCE.
• Downward pressure: no KEV, no public active exploitation, very low EPSS. Those are meaningful reasons not to call this CRITICAL.
• Net result: = ASSESSED AT HIGH. Easy remote reachability and broad endpoint population push it above MEDIUM; limited published impact and absent exploitation evidence keep it below CRITICAL.

Why not higher?

There is no published evidence here of sandbox escape, native code execution, wormability, or active exploitation. The described outcome is browser trust-boundary failure and session abuse, which can be damaging, but it does not automatically become full endpoint compromise. That keeps this out of CRITICAL.

Why not lower?

Calling this MEDIUM would overweight the vendor’s technical label and underweight the fact that the attack path is external, unauthenticated, and user-reachable through normal browsing. In a large fleet, a browser UXSS bug is not a lab curiosity; it is a realistic route to SaaS session abuse and data theft at scale.

1. Enforce browser isolation for risky cohorts — Route high-risk browsing populations such as admins, finance, executives, and helpdesk through remote browser isolation or equivalent protective browsing controls. This cuts off local exploit execution in the endpoint browser and should be deployed within 30 days for a HIGH verdict where immediate patching coverage is incomplete.
2. Force rapid browser restart compliance — Chrome often auto-downloads the fix but does not fully remediate until the browser restarts. Use MDM, GPO, or enterprise browser management to enforce restart prompts and restart deadlines so patched binaries actually take effect within 30 days across lagging endpoints.
3. Harden SaaS session abuse paths — Require step-up reauthentication for sensitive actions in IdP, admin portals, and high-value SaaS apps, and shorten session lifetimes where practical. This does not prevent UXSS, but it reduces the value of browser-context compromise and should be rolled out within 30 days for privileged user groups first.
4. Prioritize privileged browsing personas — Separate browsing profiles or dedicated hardened browsers for administrators and other high-value users reduce blast radius when a browser-context bug is hit. Apply this as a compensating control within 30 days where patch lag or legacy operational constraints exist.

Run this on the target endpoint or via your software-distribution/EDR live-response tooling. Invoke it with python3 check_chrome_cve_2026_11122.py or python check_chrome_cve_2026_11122.py; no admin rights are required for normal version checks, though some locked-down installations may need elevated access to query application paths.

#!/usr/bin/env python3
# check_chrome_cve_2026_11122.py
# Determine whether local Google Chrome is vulnerable to CVE-2026-11122
# Outputs exactly one of: VULNERABLE, PATCHED, UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import shutil
import subprocess
import sys
from pathlib import Path

TARGET = (149, 0, 7827, 53)


def parse_version(text):
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def cmp_ver(a, b):
    return (a > b) - (a < b)


def run_cmd(cmd):
    try:
        p = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, timeout=10)
        out = (p.stdout or '') + '\n' + (p.stderr or '')
        return p.returncode, out.strip()
    except Exception:
        return None, ''


def check_linux():
    candidates = [
        shutil.which('google-chrome'),
        shutil.which('google-chrome-stable'),
        shutil.which('chromium-browser'),
        shutil.which('chromium'),
        '/opt/google/chrome/chrome',
        '/usr/bin/google-chrome',
        '/usr/bin/google-chrome-stable',
    ]
    for c in candidates:
        if not c:
            continue
        rc, out = run_cmd([c, '--version'])
        ver = parse_version(out)
        if ver:
            return c, ver
    return None, None


def check_macos():
    candidates = [
        '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
        str(Path.home() / 'Applications/Google Chrome.app/Contents/MacOS/Google Chrome'),
    ]
    for c in candidates:
        if os.path.exists(c):
            rc, out = run_cmd([c, '--version'])
            ver = parse_version(out)
            if ver:
                return c, ver
    return None, None


def check_windows():
    powershell = shutil.which('powershell') or shutil.which('pwsh')
    if not powershell:
        return None, None
    ps_script = r'''
$paths = @(
  "$Env:ProgramFiles\Google\Chrome\Application\chrome.exe",
  "$Env:ProgramFiles(x86)\Google\Chrome\Application\chrome.exe",
  "$Env:LOCALAPPDATA\Google\Chrome\Application\chrome.exe"
)
foreach ($p in $paths) {
  if (Test-Path $p) {
    try {
      $v = (Get-Item $p).VersionInfo.ProductVersion
      Write-Output "$p|$v"
      exit 0
    } catch {}
  }
}
exit 1
'''
    rc, out = run_cmd([powershell, '-NoProfile', '-NonInteractive', '-Command', ps_script])
    if rc == 0 and '|' in out:
        path, ver_text = out.split('|', 1)
        ver = parse_version(ver_text)
        if ver:
            return path.strip(), ver
    return None, None


def main():
    system = platform.system().lower()
    path = None
    ver = None

    if 'linux' in system:
        path, ver = check_linux()
    elif 'darwin' in system:
        path, ver = check_macos()
    elif 'windows' in system:
        path, ver = check_windows()
    else:
        print('UNKNOWN')
        sys.exit(2)

    if not ver:
        print('UNKNOWN')
        sys.exit(2)

    # Chrome desktop stable release fixed version for this CVE is 149.0.7827.53 or later.
    # Windows/macOS may also report .54; both are patched relative to this CVE.
    if cmp_ver(ver, TARGET) >= 0:
        print('PATCHED')
        sys.exit(0)
    else:
        print('VULNERABLE')
        sys.exit(1)


if __name__ == '__main__':
    main()

Sources

1. Chrome Releases - Stable Channel Update for Desktop (June 2, 2026)
2. Chromium issue 501485453
3. Vulnerability Lookup entry for CVE-2026-11122
4. CISA Known Exploited Vulnerabilities Catalog
5. FIRST EPSS overview
6. Canadian Centre for Cyber Security advisory AV26-544
7. GovCERT.HK alert A26-06-08