Insufficient validation of untrusted input in Extensions in Google Chrome prior to 149

CVE-2026-11149 is an *Extensions* privilege-escalation bug in Google Chrome caused by insufficient validation of untrusted input. It affects Chrome versions before 149.0.7827.53 on Linux and before 149.0.7827.53/54 on Windows and macOS, and the published description is explicit about the prerequisite: the attacker must have *already compromised the renderer process* and then use a crafted HTML page to cross into a more privileged context.

The vendor-side 7.5/HIGH score overstates what defenders should patch against first on a 10,000-host estate. In the real world this is *not* unauthenticated remote compromise of Chrome from scratch; it is a second-stage browser sandbox/privilege-escalation component that only matters after a separate renderer exploit succeeds, and there is no KEV entry, no public exploitation evidence, and extremely low EPSS to offset that friction.

Why this verdict

• Major downward adjustment: the CVE description itself says the attacker must have *already compromised the renderer process*, which implies a prior successful browser exploit stage.
• Another downward adjustment: attacker position is effectively *post-initial-access within Chrome*, not clean unauthenticated remote compromise of the endpoint from nothing.
• Another downward adjustment: exposure population is broad in install base but narrow in *reachable exploitability*; only victims hit by a separate working renderer exploit can use this bug.
• Another downward adjustment: no KEV listing, no public campaign reporting, and a very low EPSS remove the normal urgency amplifiers.
• Residual upward pressure: Chrome is ubiquitous, and sandbox/privilege-escalation components are valuable when paired with a renderer bug, so this is not backlog-trash.

Why not higher?

Because this CVE is not a one-click remote takeover by itself. Requiring a separate renderer compromise plus user interaction compounds attacker cost and collapses the real reachable population compared with true standalone browser RCEs or actively exploited zero-days.

Why not lower?

Because browser escape/privilege-escalation primitives matter in real exploit chains, especially on heavily targeted user populations. If an attacker already has renderer execution, this bug may materially improve blast radius inside the browser and help turn a crash-prone foothold into a usable intrusion.

1. Enforce Chrome auto-update and relaunch compliance — Make fleet policy verify that Chrome has actually moved to 149.0.7827.53/54 or later and that users relaunch promptly so the fixed binaries are loaded. For a MEDIUM noisgate verdict there is no mitigation SLA — go straight to the 365-day remediation window, but browsers should still stay in your normal fast evergreen ring.
2. Harden extension posture — Restrict extension installs to an allowlist, remove unused extensions, and block sideloading where possible. This does not patch the bug, but it reduces the value of landing in a more privileged Extensions context; for MEDIUM, there is no mitigation SLA — go straight to the 365-day remediation window.
3. Monitor browser crash and exploit-like telemetry — Look for renderer crashes, abnormal child-process trees, rapid browser restarts, and suspicious extension API behavior in EDR/browser telemetry. This is useful because exploitation likely requires a preceding renderer bug, and for MEDIUM there is no mitigation SLA — go straight to the 365-day remediation window.
4. Keep web filtering and browser isolation tuned — Prevent delivery of the crafted HTML stage with SWG, URL filtering, and remote browser isolation for high-risk users. This only breaks the lure/delivery leg and does not replace patching; for MEDIUM, there is no mitigation SLA — go straight to the 365-day remediation window.

Run this on the target endpoint or through your software-distribution/EDR script runner. Invoke with python3 check_chrome_cve_2026_11149.py; it needs only standard user rights, though Windows registry/path access is more reliable when run in the user context where Chrome is installed.

#!/usr/bin/env python3
# check_chrome_cve_2026_11149.py
# Detect whether installed Google Chrome is vulnerable to CVE-2026-11149.
# Outputs exactly one of: VULNERABLE, PATCHED, UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import shutil
import subprocess
import sys

TARGET = (149, 0, 7827, 53)


def parse_version(text):
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def cmp_ver(a, b):
    return (a > b) - (a < b)


def run_cmd(cmd):
    try:
        p = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, timeout=10)
        out = (p.stdout or '') + ' ' + (p.stderr or '')
        return out.strip()
    except Exception:
        return ''


def windows_candidates():
    candidates = []
    for base in [os.environ.get('ProgramFiles'), os.environ.get('ProgramFiles(x86)'), os.environ.get('LocalAppData')]:
        if not base:
            continue
        candidates.append(os.path.join(base, 'Google', 'Chrome', 'Application', 'chrome.exe'))
    return [c for c in candidates if c]


def mac_candidates():
    return [
        '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
        os.path.expanduser('~/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'),
    ]


def linux_candidates():
    bins = []
    for name in ['google-chrome', 'google-chrome-stable', 'chrome', 'google-chrome-beta']:
        p = shutil.which(name)
        if p:
            bins.append(p)
    return bins


def get_version():
    system = platform.system().lower()
    candidates = []

    if 'windows' in system:
        candidates = windows_candidates()
    elif 'darwin' in system:
        candidates = mac_candidates()
    else:
        candidates = linux_candidates()

    for path in candidates:
        if os.path.exists(path) or shutil.which(path):
            out = run_cmd([path, '--version'])
            ver = parse_version(out)
            if ver:
                return ver, path, out

    # Windows registry fallback
    if 'windows' in system:
        try:
            import winreg
            reg_paths = [
                r'SOFTWARE\Google\Chrome\BLBeacon',
                r'SOFTWARE\WOW6432Node\Google\Chrome\BLBeacon',
            ]
            for hive in [winreg.HKEY_CURRENT_USER, winreg.HKEY_LOCAL_MACHINE]:
                for reg_path in reg_paths:
                    try:
                        with winreg.OpenKey(hive, reg_path) as key:
                            value, _ = winreg.QueryValueEx(key, 'version')
                            ver = parse_version(str(value))
                            if ver:
                                return ver, 'registry:' + reg_path, str(value)
                    except OSError:
                        pass
        except Exception:
            pass

    return None, None, None


def main():
    ver, source, raw = get_version()
    if not ver:
        print('UNKNOWN')
        sys.exit(2)

    if cmp_ver(ver, TARGET) < 0:
        print('VULNERABLE')
        sys.exit(1)
    else:
        print('PATCHED')
        sys.exit(0)


if __name__ == '__main__':
    main()

Sources

1. NVD entry for CVE-2026-11149
2. Chrome Releases stable desktop update for Chrome 149
3. Chromium issue 501739206
4. Chromium severity guidelines
5. CISA Known Exploited Vulnerabilities Catalog
6. FIRST EPSS overview
7. FIRST EPSS probability and percentile notes
8. MITRE CWE-20