Inappropriate implementation in XML in Google Chrome prior to 149

CVE-2026-11150 is a UXSS bug in Chrome's XML handling. In practical terms, a malicious page can abuse the browser's XML implementation to make attacker-controlled script or HTML execute in the wrong trust context after a user opens crafted content. The affected range is Chrome versions before 149.0.7827.53 on the impacted desktop builds; the fix lands at 149.0.7827.53+ (Windows/Mac early stable 149.0.7827.53/.54, Linux 149.0.7827.53).

Google's MEDIUM 6.1 label is basically right. The amplifier is obvious: Chrome is everywhere, the bug is remotely triggerable, and UXSS can turn web sessions into stolen tokens, spoofed UI, or cross-origin abuse. But the friction is just as important: exploitation still requires *user interaction*, there is no evidence of active exploitation, no KEV listing, no public exploit chain of note, and the impact is browser-context compromise, not code execution or sandbox escape.

Why this verdict

• Baseline stays near vendor 6.1 because this is unauthenticated remote content hitting one of the most widely deployed client applications in the enterprise
• Downward pressure: UI:R is real friction — the attacker must get a user to open crafted content, which implies delivery, click-through, and browser rendering all succeeding
• Downward pressure: impact is session/browser trust abuse, not host takeover — no code execution, no sandbox escape, no persistence, no direct admin blast radius from the bug itself
• Downward pressure: exposure is broad but not internet-enumerable — this is not an externally reachable server bug that can be mass-scanned and opportunistically exploited at scale
• Downward pressure: no current exploit signal — no KEV, no public exploitation reporting, and an extremely low EPSS score

Why not higher?

To reach HIGH, I'd want either active exploitation, a clean no-click path, or impact that breaks out of the browser into code execution, sandbox escape, or broad account compromise. None of that is in the record here. As written, the bug is dangerous mainly when paired with successful social engineering and valuable live browser sessions.

Why not lower?

This still hits Chrome, not some niche plugin, so the exposure population is enormous. And UXSS is not cosmetic: if a user is logged into sensitive SaaS, browser trust abuse can still mean data theft, transaction abuse, or convincing in-session phishing. That keeps it above LOW/backlog hygiene.

1. Enforce browser auto-update — Make sure enterprise policy is actually forcing Chrome to move to 149.0.7827.53+ and preventing long-lived pinned versions. For a MEDIUM noisgate verdict there is no mitigation SLA — go straight to the 365-day remediation window, but for a core browser you should still let normal update rings close this quickly rather than waiting.
2. Tighten risky content delivery — Block or detonate suspicious .html, .xml, and archive-delivered browser lures at email and web gateways, especially from newly seen senders and consumer file-sharing domains. There is no mitigation SLA for MEDIUM, so do this through regular control tuning while patching proceeds.
3. Use browser isolation for untrusted destinations — If you already have remote browser isolation or high-risk browsing segmentation, apply it to users handling payments, finance, admin panels, or sensitive SaaS data. This meaningfully reduces the value of a UXSS hit by separating risky browsing from privileged sessions; again, no mitigation SLA applies for MEDIUM.
4. Reduce session replay value — Shorten session lifetimes where practical, require step-up auth for sensitive actions, and prefer HttpOnly, origin-bound, or conditional-access-protected tokens. These controls do not stop exploitation, but they cut the attacker payoff after browser trust is abused.

Run this on the target endpoint or through your software-distribution/EDR live-response tooling. Invoke it with python3 check_chrome_cve_2026_11150.py on macOS/Linux or py check_chrome_cve_2026_11150.py on Windows; no admin rights are required unless your tooling restricts access to install paths.

#!/usr/bin/env python3
# check_chrome_cve_2026_11150.py
# Detect whether the local Chrome/Chromium installation is vulnerable to CVE-2026-11150.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import subprocess
import sys
from shutil import which

FIXED = (149, 0, 7827, 53)

CANDIDATES = {
    'Windows': [
        r'C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe',
        r'C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe',
        r'C:\\Program Files\\Chromium\\Application\\chrome.exe',
        r'C:\\Program Files (x86)\\Chromium\\Application\\chrome.exe'
    ],
    'Darwin': [
        '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
        '/Applications/Chromium.app/Contents/MacOS/Chromium'
    ],
    'Linux': [
        '/usr/bin/google-chrome',
        '/usr/bin/google-chrome-stable',
        '/usr/bin/chromium',
        '/usr/bin/chromium-browser',
        '/snap/bin/chromium'
    ]
}


def parse_version(text):
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def find_binaries():
    system = platform.system()
    found = []
    for path in CANDIDATES.get(system, []):
        if os.path.exists(path):
            found.append(path)
    for name in ['google-chrome', 'google-chrome-stable', 'chromium', 'chromium-browser', 'chrome']:
        p = which(name)
        if p and p not in found:
            found.append(p)
    return found


def get_version(binary):
    cmds = [
        [binary, '--version'],
        [binary, '-version']
    ]
    for cmd in cmds:
        try:
            out = subprocess.check_output(cmd, stderr=subprocess.STDOUT, text=True, timeout=10)
            v = parse_version(out)
            if v:
                return v, out.strip()
        except Exception:
            pass
    return None, None


def version_lt(a, b):
    return a < b


def main():
    bins = find_binaries()
    if not bins:
        print('UNKNOWN: no Chrome/Chromium binary found on standard paths or PATH')
        sys.exit(2)

    checked = []
    vulnerable = []
    patched = []

    for binary in bins:
        version, raw = get_version(binary)
        if not version:
            checked.append((binary, None, 'unable to determine version'))
            continue
        checked.append((binary, version, raw))
        if version_lt(version, FIXED):
            vulnerable.append((binary, version))
        else:
            patched.append((binary, version))

    if vulnerable:
        details = ', '.join([f'{b}={".".join(map(str, v))}' for b, v in vulnerable])
        print(f'VULNERABLE: found version(s) older than 149.0.7827.53 -> {details}')
        sys.exit(1)

    if patched:
        details = ', '.join([f'{b}={".".join(map(str, v))}' for b, v in patched])
        print(f'PATCHED: found version(s) at or newer than 149.0.7827.53 -> {details}')
        sys.exit(0)

    print('UNKNOWN: Chrome/Chromium found but version could not be determined')
    sys.exit(2)


if __name__ == '__main__':
    main()

Sources

1. CIRCL Vulnerability Lookup entry for CVE-2026-11150
2. Chrome Releases - Early Stable Update for Desktop (149.0.7827.53/.54)
3. Chrome Releases archive for 2026
4. Chromium issue reference linked from CVE record
5. CISA Known Exploited Vulnerabilities Catalog
6. FIRST EPSS project
7. SecurityWeek coverage of Chrome 149 patch release