Inappropriate implementation in Paint in Google Chrome prior to 149

CVE-2026-11139 is a Chrome client-side information disclosure issue in the Paint pipeline. A malicious site can reportedly abuse the flaw in Chrome versions prior to 149.0.7827.53 to leak *cross-origin* data via crafted web content, which means the prize is whatever the victim browser can already see or render from another origin during that session.

Google rated it MEDIUM at 6.5, and that is a little generous in enterprise terms. Same-origin-policy failures matter, but this one still requires user interaction, browser-side exploit reliability, and a victim who is simultaneously authenticated to something worth stealing; there is no evidence here of code execution, sandbox escape, KEV listing, or in-the-wild exploitation.

Why this verdict

• User click required: the attacker is unauthenticated and remote, but they still need the victim to load hostile content, which is a real friction point in enterprise fleets.
• Confidentiality-only impact: the published vector is C:H / I:N / A:N; this is data exposure, not endpoint takeover, persistence, or domain blast radius.
• Session-dependent value: the bug only matters if the victim is already browsing sensitive cross-origin content that the exploit can actually reach during that session.
• No active exploitation signals: no KEV, no confirmed campaigns, and a very low EPSS score all push this below urgent browser-zero-day territory.
• Huge product footprint keeps it out of LOW: Chrome's massive deployment means even medium-grade client bugs can produce real incident volume when a campaign appears.

Why not higher?

This is not an unauthenticated server-side bug, not a pre-auth appliance bug, and not a browser RCE or sandbox escape. The chain is narrower: lure victim, hit a specific browser build, rely on in-session cross-origin value, and then monetize stolen data without a guaranteed host compromise.

Why not lower?

Breaking browser origin isolation is still meaningful because enterprise users spend their day inside authenticated SaaS sessions. Chrome is everywhere, so once delivery works, the reachable victim population is large enough that defenders should not write this off as mere nuisance.

1. Enforce Chrome auto-update — Make sure managed browsers cannot sit below 149.0.7827.53 for long. For a MEDIUM verdict there is no mitigation SLA, so treat this as exposure reduction while you work the patch through normal browser operations and complete remediation within the 365-day window.
2. Block unmanaged browsers from sensitive apps — Use IdP conditional access, device trust, or enterprise browser controls so high-value SaaS only accepts managed and compliant browser sessions. This reduces the payoff of browser-side data leaks while you patch; again, no mitigation SLA applies for MEDIUM, but it is worth doing where the business risk is high.
3. Tighten web isolation for risky categories — Send newly registered domains, uncategorized sites, ads, and user-generated content through RBI/SWG isolation where available. That directly attacks step 1 of the chain by making hostile page delivery less likely to reach a vulnerable session before normal remediation is completed.
4. Use least-privilege browser profiles — Separate admin workflows from general browsing and avoid keeping privileged sessions open in the same browser context users use for casual web activity. This does not fix the bug, but it reduces the data value available to a successful same-origin bypass.

Run this on the endpoint itself or via your software inventory agent, because you need the locally installed Chrome version. Invoke it with python3 check_chrome_cve_2026_11139.py on macOS/Linux or py check_chrome_cve_2026_11139.py on Windows; standard user rights are usually enough, but admin may be needed if Chrome is installed in a nonstandard location.

#!/usr/bin/env python3
# Check local Google Chrome version against CVE-2026-11139 fixed version.
# Outputs one of: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import subprocess
import sys
from pathlib import Path

FIXED = (149, 0, 7827, 53)


def parse_version(s):
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', s or '')
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def version_str(v):
    return '.'.join(str(x) for x in v)


def get_version_from_command(cmd):
    try:
        out = subprocess.check_output(cmd, stderr=subprocess.STDOUT, text=True, timeout=10)
        return parse_version(out.strip())
    except Exception:
        return None


def get_windows_version():
    candidates = [
        r'C:\Program Files\Google\Chrome\Application\chrome.exe',
        r'C:\Program Files (x86)\Google\Chrome\Application\chrome.exe',
        os.path.expandvars(r'%LOCALAPPDATA%\Google\Chrome\Application\chrome.exe'),
    ]
    ps = (
        "$paths = @('C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe',"
        "'C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe',"
        "'$env:LOCALAPPDATA\\Google\\Chrome\\Application\\chrome.exe');"
        "$found = $paths | Where-Object { Test-Path $_ } | Select-Object -First 1;"
        "if ($found) { (Get-Item $found).VersionInfo.ProductVersion }"
    )
    v = get_version_from_command(["powershell", "-NoProfile", "-Command", ps])
    if v:
        return v
    for path in candidates:
        if os.path.exists(path):
            try:
                out = subprocess.check_output([
                    'powershell', '-NoProfile', '-Command',
                    f"(Get-Item '{path}').VersionInfo.ProductVersion"
                ], stderr=subprocess.STDOUT, text=True, timeout=10)
                v = parse_version(out)
                if v:
                    return v
            except Exception:
                pass
    return None


def get_macos_version():
    candidates = [
        '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
        str(Path.home() / 'Applications/Google Chrome.app/Contents/MacOS/Google Chrome'),
    ]
    for path in candidates:
        if os.path.exists(path):
            v = get_version_from_command([path, '--version'])
            if v:
                return v
    return None


def get_linux_version():
    commands = [
        ['google-chrome', '--version'],
        ['google-chrome-stable', '--version'],
        ['chromium', '--version'],
        ['chromium-browser', '--version'],
    ]
    for cmd in commands:
        v = get_version_from_command(cmd)
        if v:
            return v
    paths = [
        '/opt/google/chrome/google-chrome',
        '/usr/bin/google-chrome',
        '/usr/bin/google-chrome-stable',
        '/usr/bin/chromium',
        '/usr/bin/chromium-browser',
    ]
    for path in paths:
        if os.path.exists(path):
            v = get_version_from_command([path, '--version'])
            if v:
                return v
    return None


def main():
    system = platform.system().lower()
    if 'windows' in system:
        v = get_windows_version()
    elif 'darwin' in system:
        v = get_macos_version()
    elif 'linux' in system:
        v = get_linux_version()
    else:
        v = None

    if not v:
        print('UNKNOWN - Could not determine local Chrome/Chromium version')
        sys.exit(2)

    print(f'Detected version: {version_str(v)}')
    print(f'Fixed version threshold: {version_str(FIXED)}')

    if v < FIXED:
        print('VULNERABLE')
        sys.exit(1)
    else:
        print('PATCHED')
        sys.exit(0)


if __name__ == '__main__':
    main()

Sources

1. Chrome Releases - Early Stable Update for Desktop (149.0.7827.53/.54)
2. Chrome Releases blog homepage
3. CISA Known Exploited Vulnerabilities Catalog
4. FIRST EPSS API documentation
5. FIRST EPSS data and fields
6. Quanteta CVE tracker entry for CVE-2026-11139
7. VulDB CVE index showing CVE-2026-11139
8. StatCounter browser market share worldwide