Uninitialized Use in ANGLE in Google Chrome prior to 149

CVE-2026-11137 is an *uninitialized use* bug in Chrome's ANGLE graphics layer that affects Google Chrome versions prior to 149.0.7827.53 on Linux and 149.0.7827.53/54 on Windows and macOS. A malicious site can trigger the flaw through crafted web content and potentially disclose data from process memory, which is an information leak rather than direct code execution.

Google's MEDIUM label is basically fair. The attack starts remotely and Chrome is ubiquitous, but the real-world chain still requires *user interaction* and the technical impact is limited to confidentiality leakage from browser process memory; there is no public evidence here of sandbox escape, arbitrary code execution, or in-the-wild exploitation.

Why this verdict

• Start at vendor 6.5: Google already put this in MEDIUM, which is a reasonable baseline for a remote browser info-leak in a massively deployed product.
• User interaction pulls down: UI:R means the attacker needs a victim to load malicious content; that is materially weaker than drive-by-free server exploitation or zero-click messaging paths.
• Impact is confidentiality-only: the published vector has C:H/I:N/A:N, so this is not a direct integrity or availability event and not a published RCE or sandbox escape.
• No exploit pressure signal: no KEV listing, no reviewed public PoC, and a very low user-supplied EPSS materially reduce near-term operational urgency.
• But exposure is broad: Chrome is everywhere, externally influenced by normal browsing, and the vulnerable component is in a routine rendering path, which keeps this out of LOW.

Why not higher?

To justify HIGH, you would want at least one of these amplifiers: active exploitation, a public reliable PoC, zero-click reachability, or impact that crosses into code execution or sandbox escape. None of those are present in the reviewed record. This is a browser memory disclosure bug with user interaction and no current evidence of operational weaponization.

Why not lower?

LOW would underrate the fact that Chrome is one of the widest client-side attack surfaces in the enterprise and this bug is remotely triggerable through ordinary web content. Even without code execution, a confidentiality leak from browser process memory can expose session material or sensitive page data, so it still deserves normal patch-cycle attention.

1. Enforce browser auto-update — Make sure managed Chrome channels cannot lag behind the fixed 149.0.7827.53/54 builds. For a MEDIUM verdict there is no mitigation SLA — go straight to the 365-day remediation window, but for browsers you should still verify update policy and stale endpoints now because version drift is the only clean exposure metric.
2. Block unmanaged Chrome versions — Use EDR, MDM, or NAC policy to identify endpoints running vulnerable Chrome versions and push them into a corrective workflow. There is no separate mitigation clock here, so use this as hygiene control while completing remediation within the MEDIUM 365-day window.
3. Prefer browser isolation for risky browsing tiers — Apply remote browser isolation or hardened browsing profiles to high-risk user groups such as finance, executives, and external-content-heavy roles. This does not replace patching, but it lowers exploit reliability and helps until the fleet is uniformly remediated within the 365-day window.
4. Monitor browser-version exceptions — Build an exception report for hosts pinned to legacy Chrome versions, disabled auto-update, kiosk modes, VDI gold images, or software-distribution failures. Those long-tail systems are where medium browser flaws quietly persist.

Run this on the target endpoint or through your fleet remote-execution tool. Invoke it with python3 check_cve_2026_11137.py on macOS/Linux or py check_cve_2026_11137.py on Windows; it needs only standard user privileges and will print VULNERABLE, PATCHED, or UNKNOWN based on the locally installed Google Chrome version.

#!/usr/bin/env python3
# check_cve_2026_11137.py
# Detects whether installed Google Chrome is vulnerable to CVE-2026-11137.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import subprocess
import sys
from typing import Optional, Tuple

PATCHED = (149, 0, 7827, 53)


def parse_version(text: str) -> Optional[Tuple[int, int, int, int]]:
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def run_cmd(cmd):
    try:
        p = subprocess.run(cmd, capture_output=True, text=True, timeout=10)
        if p.returncode == 0:
            return (p.stdout or p.stderr).strip()
    except Exception:
        pass
    return None


def windows_candidates():
    return [
        os.path.join(os.environ.get('ProgramFiles', r'C:\Program Files'), 'Google', 'Chrome', 'Application', 'chrome.exe'),
        os.path.join(os.environ.get('ProgramFiles(x86)', r'C:\Program Files (x86)'), 'Google', 'Chrome', 'Application', 'chrome.exe'),
        os.path.join(os.environ.get('LocalAppData', ''), 'Google', 'Chrome', 'Application', 'chrome.exe'),
    ]


def mac_candidates():
    return [
        '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
        os.path.expanduser('~/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'),
    ]


def linux_candidates():
    return ['google-chrome', 'google-chrome-stable', 'chromium', 'chromium-browser']


def get_version() -> Optional[Tuple[int, int, int, int]]:
    system = platform.system().lower()

    if system == 'windows':
        for path in windows_candidates():
            if os.path.exists(path):
                out = run_cmd([path, '--version'])
                if out:
                    v = parse_version(out)
                    if v:
                        return v
        # Fallback to registry query via PowerShell if binary path is nonstandard
        ps = [
            'powershell', '-NoProfile', '-Command',
            r"$paths=@('HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe','HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe','HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe'); foreach($p in $paths){ try { $x=(Get-ItemProperty $p).'(default)'; if($x){ & $x --version; exit 0 } } catch {} }; exit 1"
        ]
        out = run_cmd(ps)
        if out:
            return parse_version(out)

    elif system == 'darwin':
        for path in mac_candidates():
            if os.path.exists(path):
                out = run_cmd([path, '--version'])
                if out:
                    v = parse_version(out)
                    if v:
                        return v

    else:
        for cmd in linux_candidates():
            out = run_cmd([cmd, '--version'])
            if out:
                v = parse_version(out)
                if v:
                    return v

    return None


def main():
    version = get_version()
    if not version:
        print('UNKNOWN: Google Chrome version could not be determined on this host')
        sys.exit(2)

    version_str = '.'.join(str(x) for x in version)
    if version < PATCHED:
        print(f'VULNERABLE: installed Chrome version {version_str} is older than 149.0.7827.53')
        sys.exit(1)
    else:
        print(f'PATCHED: installed Chrome version {version_str} is at or above 149.0.7827.53')
        sys.exit(0)


if __name__ == '__main__':
    main()

Sources

1. NVD CVE-2026-11137
2. Chrome Releases - Stable Channel Update for Desktop (June 2, 2026)
3. Chrome Releases - Early Stable Update for Desktop (May 29, 2026)
4. Chromium issue 501647943
5. CISA Known Exploited Vulnerabilities Catalog
6. FIRST EPSS overview
7. Canadian Centre for Cyber Security advisory AV26-544
8. Chromium severity guidelines