Insufficient validation of untrusted input in Chromoting in Google Chrome prior to 149

CVE-2026-11146 is an input-validation flaw in Chrome's Chromoting component affecting Google Chrome versions before 149.0.7827.53. The bug can let an attacker who has already compromised the renderer process use a crafted HTML page to potentially escape Chrome's sandbox, turning renderer-level code execution into a host-level foothold.

The published 9.6/CRITICAL score overstates the real enterprise urgency when assessed as a patch queue item. The decisive friction is that this is not initial access and not standalone RCE; it is a second-stage post-renderer compromise bug, and Google itself labeled the Chromium-side bug Medium. That keeps it important, because Chrome is everywhere and sandbox escapes are premium chain components, but it does not deserve top-of-queue treatment absent active exploitation.

Why this verdict

• Major downgrade: requires a prior renderer compromise — attacker position is effectively *post-exploitation inside the browser*, not unauthenticated remote code execution from scratch.
• Further downgrade: user interaction is still required — the victim must browse to crafted content, so SWG, Safe Browsing, email controls, and user behavior all reduce reach.
• Another downgrade: no exploitation evidence — no KEV listing, no public PoC found, and SSVC enrichment says Exploitation: none / Automatable: no.
• Counterweight upward: Chrome is everywhere — the affected software population is huge, so a viable sandbox escape still matters when paired with another browser bug.
• Counterweight upward: blast radius at the endpoint is real — if chained successfully, this converts renderer code exec into user-context compromise on a workstation.

Why not higher?

Because this CVE does not get the attacker into the box by itself. Requiring internal browser foothold plus a separate exploit stage is compounding friction, and there is no public evidence yet that operators are spending chains on this bug in the wild.

Why not lower?

Because sandbox escapes in Chrome are not hygiene-only bugs. In a product with Chrome's deployment footprint, a reliable chain component can materially raise attacker success once the first-stage renderer bug exists, so this should stay above backlog-only treatment.

1. Unpin lagging Chrome channels — Find OUs, VDI pools, kiosk builds, and gold images pinned below 149.0.7827.53 and remove version pinning that blocks normal browser security uptake. For a MEDIUM noisgate verdict there is no mitigation SLA — go straight to the 365-day remediation window, but do this early because browser version drift is what turns chain bugs into long-tail exposure.
2. Verify auto-update actually lands — Do not assume Chrome updated just because policy says it should. Validate managed endpoints are receiving the stable build and restarting into it; for this MEDIUM verdict there is no mitigation SLA, so use the 365-day remediation window to clean up update reliability rather than treating this like a fire drill.
3. Harden web delivery controls — Keep Safe Browsing, SWG, email URL defense, and malvertising filtering tuned because they cut off the crafted-page delivery stage before any browser chain executes. There is no mitigation SLA for MEDIUM here, but these controls reduce chain completion while remediation proceeds inside the 365-day window.
4. Watch browser child-process and exploit telemetry — Prioritize detections for suspicious browser-launched shells, script engines, LOLBins, and memory abuse from chrome.exe or Chrome child processes. This does not patch the bug, but it is the most useful runtime control if an attacker tries to turn a renderer exploit into post-sandbox endpoint actions.

Run this on the target endpoint or through your endpoint audit tooling. Invoke it with python3 check_cve_2026_11146.py on macOS/Linux or py check_cve_2026_11146.py on Windows; standard user rights are usually enough because it reads local install metadata and common binary paths.

#!/usr/bin/env python3
# check_cve_2026_11146.py
# Detect whether locally installed Google Chrome is vulnerable to CVE-2026-11146
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import subprocess
import sys
from shutil import which

FIXED_VERSION = (149, 0, 7827, 53)


def parse_version(text):
    if not text:
        return None
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def compare_versions(a, b):
    if a is None or b is None:
        return None
    return (a > b) - (a < b)


def run_cmd(cmd):
    try:
        cp = subprocess.run(cmd, capture_output=True, text=True, timeout=10)
        out = (cp.stdout or '') + '\n' + (cp.stderr or '')
        return out.strip()
    except Exception:
        return ''


def windows_version():
    candidates = [
        r'C:\Program Files\Google\Chrome\Application\chrome.exe',
        r'C:\Program Files (x86)\Google\Chrome\Application\chrome.exe',
        os.path.expandvars(r'%LOCALAPPDATA%\Google\Chrome\Application\chrome.exe'),
    ]

    for path in candidates:
        if path and os.path.exists(path):
            out = run_cmd(['powershell', '-NoProfile', '-Command', f"(Get-Item '{path}').VersionInfo.ProductVersion"])
            ver = parse_version(out)
            if ver:
                return ver, path

    reg_queries = [
        [
            'reg', 'query',
            r'HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe',
            '/ve'
        ],
        [
            'reg', 'query',
            r'HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe',
            '/ve'
        ],
    ]

    for q in reg_queries:
        out = run_cmd(q)
        m = re.search(r'REG_SZ\s+(.+chrome\.exe)', out, re.IGNORECASE)
        if m:
            path = m.group(1).strip()
            if os.path.exists(path):
                pout = run_cmd(['powershell', '-NoProfile', '-Command', f"(Get-Item '{path}').VersionInfo.ProductVersion"])
                ver = parse_version(pout)
                if ver:
                    return ver, path

    return None, None


def mac_version():
    app = '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'
    if os.path.exists(app):
        out = run_cmd([app, '--version'])
        ver = parse_version(out)
        if ver:
            return ver, app
    return None, None


def linux_version():
    binaries = [
        'google-chrome',
        'google-chrome-stable',
        '/opt/google/chrome/google-chrome',
        '/usr/bin/google-chrome',
        '/usr/bin/google-chrome-stable',
    ]
    for b in binaries:
        path = b if os.path.isabs(b) else which(b)
        if path:
            out = run_cmd([path, '--version'])
            ver = parse_version(out)
            if ver:
                return ver, path
    return None, None


def main():
    system = platform.system().lower()
    ver = None
    path = None

    if 'windows' in system:
        ver, path = windows_version()
    elif 'darwin' in system:
        ver, path = mac_version()
    elif 'linux' in system:
        ver, path = linux_version()
    else:
        print('UNKNOWN: unsupported platform for this checker')
        sys.exit(2)

    if ver is None:
        print('UNKNOWN: Google Chrome not found or version unreadable')
        sys.exit(2)

    cmp_result = compare_versions(ver, FIXED_VERSION)
    ver_str = '.'.join(str(x) for x in ver)
    fixed_str = '.'.join(str(x) for x in FIXED_VERSION)

    if cmp_result < 0:
        print(f'VULNERABLE: Google Chrome {ver_str} detected at {path}; fixed version is {fixed_str}')
        sys.exit(1)
    else:
        print(f'PATCHED: Google Chrome {ver_str} detected at {path}; fixed threshold is {fixed_str}')
        sys.exit(0)


if __name__ == '__main__':
    main()

Sources

1. Google Chrome Releases - Stable Channel Update for Desktop
2. NVD - CVE-2026-11146
3. OpenCVE - CVE-2026-11146
4. Tenable - CVE-2026-11146
5. CISA Known Exploited Vulnerabilities Catalog
6. FIRST EPSS API documentation
7. Chromium Security Severity Guidelines
8. StatCounter Desktop Browser Market Share Worldwide