Inappropriate implementation in DevTools in Google Chrome prior to 149

CVE-2026-11126 is a DevTools input-validation flaw in Google Chrome that affects versions before 149.0.7827.53. The published CNA text says an attacker must convince a user to install a malicious Chrome extension, after which the flaw can be used to leak cross-origin data via a crafted extension. Fixed desktop builds are 149.0.7827.53 on Linux and 149.0.7827.53/54 on Windows and macOS.

Reality is lower urgency than the word 'cross-origin' makes it sound. This is not a drive-by web exploit, not an RCE, not a sandbox escape, and not an unauthenticated internet-facing server bug; it is a client-side privacy boundary failure gated by malicious extension install. In a managed enterprise that already blocks or allowlists extensions, the reachable population collapses hard, which is why this lands in LOW despite the browser-wide name recognition.

Why this verdict

• No vendor CVSS exists, so start from the published behavior: Google describes a Medium Chromium-severity client-side data leak, not RCE or sandbox escape.
• Requires malicious extension install first: that implies prior social engineering or policy failure. In enterprise terms, this is post-initial-compromise of the browser trust model, not an internet-reachable first-hop exploit.
• Reachable population is much smaller than Chrome's install base: organizations enforcing extension allowlists, force-installs, or managed browser policy remove most of the attack surface before the CVE matters.
• Impact is confidentiality loss in-browser, not system compromise: the published effect is cross-origin data leakage, which is real but materially less urgent than code execution or container breakout.
• Threat telemetry is quiet: no KEV, no public exploitation evidence in reviewed sources, and the supplied EPSS 0.00016 is extremely low.

Why not higher?

A higher rating would require either web-only reachability, active exploitation, or host-level consequences. This CVE has none of those in the published record: the attacker needs a malicious extension foothold first, and the stated impact is limited to cross-origin data leakage. That combination is too narrow for MEDIUM-or-higher emergency treatment across a 10,000-host fleet.

Why not lower?

I am not calling this IGNORE because it still represents a real browser security-boundary failure in a massively deployed client, and unmanaged or lightly managed Chrome populations do exist. If your estate permits broad user-installed extensions, this bug is a useful amplifier for that preexisting weakness, so it belongs in the backlog rather than the trash bin.

1. Enforce an extension allowlist — Use Chrome Enterprise ExtensionInstallAllowlist / ExtensionSettings so only approved extensions can be installed. This directly kills the hardest prerequisite in the chain; for a LOW verdict there is no mitigation SLA (treat as backlog hygiene), but this is still the best control if your extension posture is loose.
2. Hunt for high-risk extension permissions — Review installed extensions for broad host access, debugger, and uncommon DevTools-related behaviors, then remove anything unapproved. Do this through Chrome Admin reports or local inventory; for LOW, there is no mitigation SLA, so fold it into your normal browser governance cycle.
3. Inventory unmanaged Chrome — Find browsers not enrolled in Chrome Enterprise Core, GPO, MDM, or equivalent management, because those are the endpoints where user-installed malicious extensions are most likely. There is no mitigation SLA for LOW, but this is the population where the CVE is actually relevant.
4. Constrain browser egress where practical — Use SWG/DNS controls to make extension-driven exfiltration louder by restricting newly seen or low-reputation destinations. This will not prevent the boundary failure itself, but it adds friction to step 4 of the chain; again, no mitigation SLA applies at LOW.

Run this on the target endpoint or through your EDR/remote execution layer. Invoke it with python3 check_chrome_cve_2026_11126.py; it needs no administrator privileges, but it does need permission to execute the local Chrome binary or read standard install paths. It reports VULNERABLE, PATCHED, or UNKNOWN based on whether the installed Google Chrome version is earlier than 149.0.7827.53.

#!/usr/bin/env python3
# check_chrome_cve_2026_11126.py
# Determine whether locally installed Google Chrome is vulnerable to CVE-2026-11126.
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN

import os
import platform
import re
import shutil
import subprocess
import sys
from typing import Optional, Tuple

FIXED = (149, 0, 7827, 53)


def run_version(cmd):
    try:
        p = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, timeout=10)
        out = (p.stdout or "") + "\n" + (p.stderr or "")
        return out.strip()
    except Exception:
        return ""


def parse_version(text: str) -> Optional[Tuple[int, int, int, int]]:
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def find_chrome() -> Optional[str]:
    system = platform.system().lower()

    if system == 'windows':
        candidates = [
            os.path.join(os.environ.get('ProgramFiles', r'C:\Program Files'), 'Google', 'Chrome', 'Application', 'chrome.exe'),
            os.path.join(os.environ.get('ProgramFiles(x86)', r'C:\Program Files (x86)'), 'Google', 'Chrome', 'Application', 'chrome.exe'),
            os.path.join(os.environ.get('LocalAppData', ''), 'Google', 'Chrome', 'Application', 'chrome.exe'),
        ]
        for c in candidates:
            if c and os.path.exists(c):
                return c
        return None

    if system == 'darwin':
        candidates = [
            '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
            os.path.expanduser('~/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'),
        ]
        for c in candidates:
            if os.path.exists(c):
                return c
        return None

    # Linux / other Unix-like
    for name in ['google-chrome', 'google-chrome-stable', 'chrome']:
        path = shutil.which(name)
        if path:
            return path
    return None


def get_version(path: str) -> Optional[Tuple[int, int, int, int]]:
    out = run_version([path, '--version'])
    return parse_version(out)


def main():
    chrome = find_chrome()
    if not chrome:
        print('UNKNOWN: Google Chrome executable not found')
        sys.exit(2)

    version = get_version(chrome)
    if not version:
        print(f'UNKNOWN: Unable to determine version from {chrome}')
        sys.exit(2)

    if version < FIXED:
        print(f'VULNERABLE: Google Chrome {".".join(map(str, version))} < 149.0.7827.53 ({chrome})')
        sys.exit(1)
    else:
        print(f'PATCHED: Google Chrome {".".join(map(str, version))} >= 149.0.7827.53 ({chrome})')
        sys.exit(0)


if __name__ == '__main__':
    main()

Sources

1. Chrome Releases: Stable Channel Update for Desktop
2. CIRCL Vulnerability-Lookup search result containing CVE-2026-11126 CNA text
3. Chromium issue tracker entry 501528031
4. CISA Known Exploited Vulnerabilities Catalog
5. FIRST EPSS project
6. Chrome Enterprise policy: Extension Install Allowlist
7. Chrome for Developers: chrome.debugger API
8. Chrome for Developers: Permission warning guidelines