Insufficient policy enforcement in Paint in Google Chrome prior to 149

CVE-2026-11142 is a Chrome client-side same-origin policy bypass in the Paint component. A victim has to browse to attacker-controlled HTML, and affected builds are Chrome versions before 149.0.7827.53; Google lists the fix in 149.0.7827.53 for Linux and 149.0.7827.53/54 for Windows and Mac, with Android inheriting the same desktop security fixes in 149.0.7827.59.

Google's MEDIUM 6.5 baseline is close, but a little generous once you do the friction audit. This is not wormable, not unauthenticated service exposure, not code execution, and not a perimeter-scannable server bug; it is a user-driven browser trust-boundary break that matters because Chrome is everywhere, but the practical blast radius usually stays bounded to the victim's browser session and whatever web apps they are already logged into.

Why this verdict

• UI:R cuts the score down — the attacker needs the victim to load crafted web content, which is materially weaker than an internet-facing unauthenticated service exploit.
• Client-side only, not perimeter-reachable — this is a browser-session problem, so Shodan/Censys-style exposure scaling does not apply and SOC teams must already have endpoint/browser inventory to even find it.
• Integrity impact is real but bounded — the main consequence is cross-origin action abuse inside the victim's logged-in browser context, not host takeover or broad tenant compromise.
• No exploitation evidence — no KEV listing, no public PoC found, and Google kept bug details restricted, all of which reduce immediate operational risk.
• Chrome ubiquity keeps it from going LOW — unlike a niche plugin flaw, this sits in a massively deployed browser, so even a medium-grade trust-boundary bug can hit a large user population if version lag exists.

Why not higher?

There is no evidence here of sandbox escape, arbitrary code execution, wormability, or active exploitation. The attack still needs a victim browsing event and usually only buys the attacker whatever abuse they can squeeze from that user's active web sessions.

Why not lower?

A same-origin policy bypass is still a browser trust-boundary failure, not cosmetic noise. In a large enterprise with federated SaaS and always-on SSO sessions, per-user session abuse can translate into meaningful account actions, especially against internal admin portals and business apps.

1. Force browser auto-update compliance — Use enterprise browser management, MDM, or endpoint tooling to drive Chrome to 149.0.7827.53/54 or later and measure drift. For a MEDIUM verdict there is no mitigation SLA, so keep this in normal change flow and close it inside the 365-day remediation window, though most teams should finish browser rollout much sooner because the operational cost is low.
2. Tighten risky web content paths — Reduce exposure to malicious HTML delivery by hardening ad/script controls, disabling unnecessary extension sprawl, and using browser isolation for high-risk user groups. There is no mitigation SLA — go straight to the remediation window — but these controls are useful while patch compliance catches up.
3. Watch for web-session abuse — Ask IAM and SaaS owners to review anomalous state-changing actions, suspicious origin/referrer patterns, and step-up authentication triggers from managed Chrome endpoints that remain below the fixed version. This is especially relevant for admin portals where a browser trust-boundary miss can still translate to real business impact.
4. Prioritize exposed user populations — Front-load updates for admins, finance, HR, help desk, and developers who maintain long-lived authenticated browser sessions. Even without a formal mitigation deadline for MEDIUM, these cohorts carry more downstream blast radius if the browser session is abused.

Run this on the target endpoint or through your software-distribution/EDR remote execution channel. Invoke with python3 chrome_cve_2026_11142_check.py; no admin rights are required for basic version detection, but broader path coverage on Windows/macOS/Linux is better with a standard managed-user context.

#!/usr/bin/env python3
# chrome_cve_2026_11142_check.py
# Check Google Chrome version against CVE-2026-11142 fixed builds.
# Outputs: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import shutil
import subprocess
import sys

TARGET = (149, 0, 7827, 53)  # minimum fixed baseline


def parse_version(text):
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text or '')
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def cmp_ver(a, b):
    return (a > b) - (a < b)


def run_cmd(cmd):
    try:
        p = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, timeout=10)
        if p.returncode == 0:
            return (p.stdout or p.stderr).strip()
        return (p.stdout or p.stderr).strip()
    except Exception:
        return ''


def candidate_commands():
    system = platform.system().lower()
    cmds = []

    if system == 'windows':
        local = os.environ.get('LOCALAPPDATA', '')
        programfiles = os.environ.get('ProgramFiles', '')
        programfilesx86 = os.environ.get('ProgramFiles(x86)', '')
        paths = [
            os.path.join(programfiles, 'Google', 'Chrome', 'Application', 'chrome.exe'),
            os.path.join(programfilesx86, 'Google', 'Chrome', 'Application', 'chrome.exe'),
            os.path.join(local, 'Google', 'Chrome', 'Application', 'chrome.exe'),
        ]
        for p in paths:
            if p and os.path.exists(p):
                cmds.append([p, '--version'])
        # Registry fallback via PowerShell
        cmds.append(['powershell', '-NoProfile', '-Command', "(Get-Item 'HKLM:\\Software\\Microsoft\\Windows\\CurrentVersion\\App Paths\\chrome.exe').GetValue('')"])
        cmds.append(['powershell', '-NoProfile', '-Command', "(Get-ItemProperty 'HKLM:\\Software\\Google\\Chrome\\BLBeacon' -ErrorAction SilentlyContinue).version"])
        cmds.append(['powershell', '-NoProfile', '-Command', "(Get-ItemProperty 'HKCU:\\Software\\Google\\Chrome\\BLBeacon' -ErrorAction SilentlyContinue).version"])

    elif system == 'darwin':
        mac_paths = [
            '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
            os.path.expanduser('~/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'),
        ]
        for p in mac_paths:
            if os.path.exists(p):
                cmds.append([p, '--version'])
        cmds.append(['mdls', '-name', 'kMDItemVersion', '/Applications/Google Chrome.app'])

    else:
        names = ['google-chrome', 'google-chrome-stable', 'chromium', 'chromium-browser']
        for name in names:
            path = shutil.which(name)
            if path:
                cmds.append([path, '--version'])
        # Package manager fallbacks
        cmds.append(['bash', '-lc', "dpkg-query -W -f='${Version}\n' google-chrome-stable 2>/dev/null"])
        cmds.append(['bash', '-lc', "rpm -q --qf '%{VERSION}-%{RELEASE}\n' google-chrome-stable 2>/dev/null"])

    return cmds


def get_version():
    seen = []
    for cmd in candidate_commands():
        out = run_cmd(cmd)
        if out:
            seen.append(out)
            ver = parse_version(out)
            if ver:
                return ver, out
    return None, '\n'.join(seen)


def main():
    ver, raw = get_version()
    if not ver:
        print('UNKNOWN: Google Chrome version not detected')
        sys.exit(2)

    # Windows/Mac may be 149.0.7827.54; Linux noted as 149.0.7827.53.
    # Treat any version >= 149.0.7827.53 as patched for this CVE.
    if cmp_ver(ver, TARGET) >= 0:
        print(f'PATCHED: detected Chrome version {ver[0]}.{ver[1]}.{ver[2]}.{ver[3]}')
        sys.exit(0)
    else:
        print(f'VULNERABLE: detected Chrome version {ver[0]}.{ver[1]}.{ver[2]}.{ver[3]}')
        sys.exit(1)


if __name__ == '__main__':
    main()

Sources

1. Google Chrome stable desktop update 149
2. Google Chrome for Android update 149
3. Chromium issue 501668745
4. Chromium Security page
5. CISA Known Exploited Vulnerabilities Catalog
6. FIRST EPSS API documentation
7. FIRST EPSS documentation
8. Vulnerability-Lookup entry for CVE-2026-11142