Integer overflow in Skia in Google Chrome prior to 149

CVE-2026-11124 is a client-side memory-corruption bug in Chrome's Skia rendering stack. The CNA record says an *integer overflow* can lead to heap corruption from a crafted HTML page in Google Chrome versions earlier than 149.0.7827.53; Google shipped the fix in the Chrome 149 stable release for Linux 149.0.7827.53 and Windows/macOS 149.0.7827.53/.54. There is a minor metadata mismatch worth noting: Google's release post labels the entry as *heap buffer overflow in Skia*, while the CVE text describes an *integer overflow* that can cause heap corruption.

Google's own severity label is *Medium*, and that is understandable if you score only the immediate bug and assume the browser sandbox holds. In enterprise reality, though, this lands higher: Chrome is everywhere, delivery is cheap for attackers because normal browsing is enough, and rendering bugs are exactly the class that turns malvertising or phishing clicks into initial footholds. The main downward pressures are real too: user interaction is required, there is no public in-the-wild exploitation in the sources reviewed, and the likely first-stage impact is renderer compromise rather than instant full-host takeover.

Why this verdict

• Massively exposed client surface: Chrome is ubiquitous, and the attacker position is only *unauthenticated remote plus user browse event*. That means a wide reachable population across enterprise endpoints, not a niche admin-only feature.
• Low delivery cost, not low exploit cost: the attacker can deliver via ordinary web content, phishing, ads, or compromised sites, so perimeter controls do not eliminate the risk. I adjusted the score upward because the first hop does not require credentials, internal access, or special roles.
• Sandbox is real downward pressure: successful exploitation likely starts in the renderer, which implies constrained privileges and often requires a second bug for full-host compromise. I adjusted the score downward for that compounding friction.
• No active exploitation signal: EPSS is extremely low and the CVE is not in KEV. That removes the biggest reason to call this critical.
• Vendor medium is a bit too calm for fleet prioritization: for a 10,000-host enterprise, one-click browser memory corruption on a universal app deserves faster attention than a generic medium backlog item, even if the browser sandbox keeps it from being top-shelf emergency patching.

Why not higher?

There is no evidence in the reviewed sources that this is being exploited in the wild, and there is no public PoC raising the immediate copycat risk. More importantly, the likely first-stage win is inside Chrome's sandboxed renderer, not an automatic full endpoint takeover, so the blast radius is meaningfully constrained unless the attacker can chain another flaw.

Why not lower?

Scoring this as medium would underweight the real exposure population: browser rendering bugs are one of the cleanest ways to touch a huge endpoint fleet with almost no attacker-side prerequisites. Even with the sandbox, a remotely delivered memory-corruption bug in a universally deployed browser is too operationally important to treat as routine backlog hygiene.

1. Enforce rapid Chrome auto-update — Make sure enterprise policy does not defer stable-channel browser updates longer than necessary, and verify endpoints are actually pulling 149.0.7827.53 or later. For a HIGH verdict, get this enforced within 30 days where patching is lagging.
2. Block unmanaged or stale browser versions — Use MDM, EDR, NAC, or conditional access to identify and restrict endpoints still running older Chrome builds. This reduces the reachable population while the fleet converges, and for a HIGH verdict the control should be in place within 30 days.
3. Harden web-content delivery paths — Tighten DNS filtering, secure web gateway policy, Safe Browsing enforcement, and ad/malware category blocking to cut off common delivery channels like phishing pages and malvertising. These are compensating controls, not fixes, and they should be tuned within 30 days.
4. Prefer browser isolation for high-risk users — For administrators, finance, help desk, and users with broad SaaS access, route untrusted browsing through remote browser isolation if you have it. That meaningfully reduces exploit usefulness during the patch convergence period and should be prioritized within 30 days for exposed groups.

Run this on the target endpoint or through your software-distribution/EDR script runner. Invoke it with python3 chrome_cve_2026_11124_check.py on macOS/Linux or py chrome_cve_2026_11124_check.py on Windows; no admin rights are normally required, but elevated rights can help if Chrome is installed system-wide in nonstandard paths.

#!/usr/bin/env python3
# CVE-2026-11124 Chrome version check
# Outputs one of: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import shutil
import subprocess
import sys
from typing import Optional, Tuple

PATCH_VERSION = (149, 0, 7827, 53)


def parse_version(text: str) -> Optional[Tuple[int, int, int, int]]:
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def run_cmd(cmd):
    try:
        p = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, timeout=10)
        out = (p.stdout or '') + '\n' + (p.stderr or '')
        return out.strip()
    except Exception:
        return ''


def find_windows_version() -> Optional[Tuple[int, int, int, int]]:
    candidates = [
        os.path.expandvars(r'%ProgramFiles%\Google\Chrome\Application\chrome.exe'),
        os.path.expandvars(r'%ProgramFiles(x86)%\Google\Chrome\Application\chrome.exe'),
        os.path.expandvars(r'%LocalAppData%\Google\Chrome\Application\chrome.exe'),
    ]
    powershell = shutil.which('powershell') or shutil.which('pwsh')
    for path in candidates:
        if os.path.exists(path) and powershell:
            script = f"(Get-Item '{path}').VersionInfo.ProductVersion"
            out = run_cmd([powershell, '-NoProfile', '-Command', script])
            v = parse_version(out)
            if v:
                return v
    return None


def find_macos_version() -> Optional[Tuple[int, int, int, int]]:
    candidates = [
        '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
        os.path.expanduser('~/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'),
    ]
    for path in candidates:
        if os.path.exists(path):
            out = run_cmd([path, '--version'])
            v = parse_version(out)
            if v:
                return v
    return None


def find_linux_version() -> Optional[Tuple[int, int, int, int]]:
    candidates = ['google-chrome', 'google-chrome-stable', 'chromium', 'chromium-browser']
    for exe in candidates:
        path = shutil.which(exe)
        if path:
            out = run_cmd([path, '--version'])
            v = parse_version(out)
            if v:
                return v
    return None


def compare_versions(found: Tuple[int, int, int, int], fixed: Tuple[int, int, int, int]) -> int:
    if found < fixed:
        return -1
    if found > fixed:
        return 1
    return 0


def main():
    system = platform.system().lower()
    version = None

    if 'windows' in system:
        version = find_windows_version()
    elif 'darwin' in system or 'mac' in system:
        version = find_macos_version()
    elif 'linux' in system:
        version = find_linux_version()

    if not version:
        print('UNKNOWN: Could not determine installed Chrome/Chromium version')
        sys.exit(2)

    cmp_result = compare_versions(version, PATCH_VERSION)
    version_str = '.'.join(str(x) for x in version)
    fixed_str = '.'.join(str(x) for x in PATCH_VERSION)

    if cmp_result < 0:
        print(f'VULNERABLE: Detected version {version_str} < fixed baseline {fixed_str}')
        sys.exit(1)
    else:
        print(f'PATCHED: Detected version {version_str} >= fixed baseline {fixed_str}')
        sys.exit(0)


if __name__ == '__main__':
    main()

Sources

1. Google Chrome Releases - Stable Channel Update for Desktop
2. Chromium issue 501511299
3. CIRCL Vulnerability-Lookup search entry for CVE-2026-11124
4. CISA Known Exploited Vulnerabilities Catalog
5. FIRST EPSS data and stats
6. Chromium Security Page
7. NVD entry for adjacent same-release Chrome CVE-2026-11164