Uninitialized Use in ANGLE in Google Chrome prior to 149

CVE-2026-11123 is an *uninitialized use* bug in ANGLE, Chrome's graphics translation layer, affecting Google Chrome versions before 149.0.7827.53. A malicious page can drive the vulnerable code path and cause the browser to expose stale process memory to the attacker, meaning the practical impact is information disclosure rather than code execution. The affected product status published by Chrome marks Chrome < 149.0.7827.53 as vulnerable, with the fix landing in the 149.0.7827.53 release train.

Google labels the bug's *Chromium security severity* as Medium, and that lines up with reality. The attacker gets web reach, which matters because Chrome is everywhere, but the payload here is a memory leak with user interaction, not a sandbox escape, not renderer RCE, and not OS compromise. For enterprise prioritization, this is a browser hygiene patch, not an all-hands emergency.

Why this verdict

• User interaction required: the attacker needs a user to render a crafted page, which is materially weaker than an unauthenticated remote service bug.
• Impact is confidentiality-only: this is a memory leak from ANGLE, not sandbox escape, not arbitrary code execution, and not host compromise.
• Population is huge but exposure is client-side: Chrome's footprint keeps this relevant, yet it is not a directly exposed edge service that can be mass-scanned and indiscriminately hammered.
• Threat telemetry is cold: no KEV listing, very low EPSS from the supplied intel, and no public PoC located reduce immediate attacker pressure.

Why not higher?

To justify HIGH, I would want either stronger impact or stronger attacker proof: active exploitation, a clean public exploit path, or a pivot from leak to sandbox escape. None of that is present in the published record for this CVE. The current story is a browser memory disclosure with user interaction and partial payoff.

Why not lower?

I am not pushing this to LOW because Chrome is a massively deployed attack surface and a web-delivered bug can still be exercised at scale through phishing or malvertising. Even partial browser-process disclosure can expose data you care about, especially for users handling sensitive web apps.

1. Enforce Chrome auto-update — Make sure desktop management actually converges endpoints onto 149.0.7827.53+. Because this is a MEDIUM verdict, there is no mitigation SLA — go straight to the 365-day remediation window, but for a browser fleet you should still validate update drift quickly rather than let stragglers age out.
2. Reduce untrusted web exposure — Push high-risk users through secure web gateway filtering, browser isolation, or stricter ad/tracker blocking where available. These controls reduce the chance users ever render the malicious page; for MEDIUM, there is no noisgate mitigation SLA, so use this as risk reduction where patch latency is unavoidable.
3. Inventory laggards aggressively — Query EDR/MDM/software inventory for Chrome versions below 149.0.7827.53 and treat unmanaged endpoints as exceptions. For this severity bucket, the deadline driver is the ≤365-day remediation window, not an emergency interim block.
4. Harden browser egress for sensitive groups — For admins, finance, and developers, tighten outbound web categories and scrutinize access to newly seen domains. It won't fix the bug, but it lowers the odds of the user ever hitting the exploit page while you complete remediation inside the allowed window.

Run this on the target endpoint or via your remote execution tooling (python3 chrome_cve_check.py on macOS/Linux, py chrome_cve_check.py on Windows). It needs no admin privileges if Chrome is installed in standard user/system locations; it returns VULNERABLE, PATCHED, or UNKNOWN and exits 0, 1, or 2 respectively.

#!/usr/bin/env python3
# Check local Google Chrome / Chromium version against CVE-2026-11123 fixed version
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN

import os
import platform
import re
import shutil
import subprocess
import sys
from pathlib import Path

FIXED = (149, 0, 7827, 53)


def parse_version(s):
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', s or '')
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def run_cmd(cmd):
    try:
        p = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, timeout=10)
        out = (p.stdout or '') + '\n' + (p.stderr or '')
        return out.strip()
    except Exception:
        return ''


def windows_candidates():
    local = os.environ.get('LOCALAPPDATA', '')
    program_files = os.environ.get('ProgramFiles', '')
    program_files_x86 = os.environ.get('ProgramFiles(x86)', '')
    return [
        Path(program_files) / 'Google/Chrome/Application/chrome.exe',
        Path(program_files_x86) / 'Google/Chrome/Application/chrome.exe',
        Path(local) / 'Google/Chrome/Application/chrome.exe',
        Path(program_files) / 'Chromium/Application/chrome.exe',
        Path(program_files_x86) / 'Chromium/Application/chrome.exe',
        Path(local) / 'Chromium/Application/chrome.exe',
    ]


def mac_candidates():
    return [
        Path('/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'),
        Path.home() / 'Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
        Path('/Applications/Chromium.app/Contents/MacOS/Chromium'),
        Path.home() / 'Applications/Chromium.app/Contents/MacOS/Chromium',
    ]


def linux_candidates():
    names = ['google-chrome', 'google-chrome-stable', 'chromium', 'chromium-browser']
    found = []
    for name in names:
        p = shutil.which(name)
        if p:
            found.append(Path(p))
    found.extend([
        Path('/opt/google/chrome/chrome'),
        Path('/usr/bin/google-chrome'),
        Path('/usr/bin/google-chrome-stable'),
        Path('/usr/bin/chromium'),
        Path('/usr/bin/chromium-browser'),
    ])
    return found


def get_version_from_binary(path):
    if not path.exists():
        return None
    out = run_cmd([str(path), '--version'])
    ver = parse_version(out)
    if ver:
        return ver, str(path), out.strip()
    return None


def main():
    system = platform.system().lower()
    candidates = []

    if 'windows' in system:
        candidates = windows_candidates()
    elif 'darwin' in system:
        candidates = mac_candidates()
    else:
        candidates = linux_candidates()

    seen = set()
    results = []
    for c in candidates:
        c = Path(c)
        key = str(c)
        if key in seen:
            continue
        seen.add(key)
        info = get_version_from_binary(c)
        if info:
            results.append(info)

    if not results:
        print('UNKNOWN - Chrome/Chromium binary not found or version unreadable')
        sys.exit(2)

    # choose highest discovered version
    results.sort(key=lambda x: x[0], reverse=True)
    ver, path, raw = results[0]
    ver_str = '.'.join(str(x) for x in ver)
    fixed_str = '.'.join(str(x) for x in FIXED)

    if ver < FIXED:
        print(f'VULNERABLE - detected {ver_str} at {path}; fixed version is {fixed_str}')
        sys.exit(1)
    else:
        print(f'PATCHED - detected {ver_str} at {path}; fixed version is {fixed_str}')
        sys.exit(0)


if __name__ == '__main__':
    main()

Sources

1. Chrome CNA record mirror for CVE-2026-11123
2. Chromium issue 501505198
3. Chrome stable desktop advisory referenced by the CVE record
4. Chrome early stable desktop update 149.0.7827.53/.54
5. Chrome beta desktop update 149.0.7827.53
6. CISA Known Exploited Vulnerabilities Catalog
7. FIRST EPSS data documentation
8. FIRST EPSS API endpoint pattern for per-CVE lookups