Insufficient validation of untrusted input in Password Manager in Google Chrome prior to 149

CVE-2026-11151 is an input-validation flaw in Chrome Password Manager that affects Google Chrome versions earlier than 149.0.7827.53. The authoritative record published on 2026-06-04 says exploitation requires a remote attacker to have already compromised the renderer process, then use a crafted HTML page to *potentially* turn that foothold into a sandbox escape. For defenders, that means this is not a stand-alone drive-by; it is a chainable browser post-compromise primitive.

The vendor/CISA-ADP 7.5 HIGH score captures the *possible* end impact, but it overshoots enterprise patch priority when you audit the real attack path. The decisive friction is the prerequisite renderer compromise: the attacker needs another browser bug first, plus user interaction, and there is no KEV listing, no public exploitation evidence, and a very low EPSS. That pushes this down into MEDIUM in real-world fleet prioritization, even though it remains strategically interesting to browser exploit developers.

Why this verdict

• Start at 7.5 HIGH: the published CVSS assumes total impact if the chain succeeds, so the baseline is fair in a vacuum
• Major downward pressure: the attacker must have *already* compromised the Chrome renderer, which implies a prior exploit stage and makes this post-initial-access within the browser attack chain
• More friction: exploitation needs user interaction and a crafted HTML page, so this is not a silent wormable path
• No current threat signal: no KEV entry, SSVC says exploitation none, and EPSS 0.00047 is extremely low
• Still not low-value: Chrome is ubiquitous and sandbox-escape primitives are strategically valuable when paired with another renderer bug

Why not higher?

Because this is not a one-bug compromise from a clean browser state. Requiring a prior renderer compromise compounds friction hard: the attacker needs another exploit first, then needs this bug to extend that foothold. That sharply narrows the reachable population and raises operational complexity.

Why not lower?

Because if an attacker already has renderer execution, a sandbox-escape-capable primitive inside Chrome is still meaningful. On a fleet with lots of Chrome usage, chained browser exploitation remains a credible risk class even when opportunistic mass exploitation is unlikely.

1. Enforce Chrome auto-update policy — Use enterprise browser policy, MDM, or software distribution to pin the fleet at 149.0.7827.53/.54 or later. For a MEDIUM verdict there is no mitigation SLA, so treat this as part of the normal remediation cycle and complete it within the <=365 day remediation window.
2. Prioritize high-risk user tiers — Move admins, developers, executives, and external-facing staff onto the patched build first because they are the most realistic browser exploit-chain targets. There is no mitigation SLA here, but risk-based acceleration inside the <=365 day remediation window is sensible.
3. Reduce credential exposure in-browser — Where business-tolerable, restrict browser password storage/autofill for privileged accounts and service admin workflows so a successful browser chain yields less value. For this MEDIUM verdict, use it as a defense-in-depth measure during the normal remediation window rather than as an emergency containment step.
4. Hunt for browser exploit telemetry — Review EDR and browser crash telemetry for abnormal Chrome child processes, exploit mitigation events, repeated renderer crashes, and suspicious browser-originated process launches. This does not replace patching, but it is the best available control while the fleet rolls through the <=365 day remediation cycle.

Run this on the target endpoint itself or through your RMM/EDR remote script runner. Invoke it with python3 check_chrome_cve_2026_11151.py on macOS/Linux or py check_chrome_cve_2026_11151.py on Windows; no admin rights are normally required, but the account must be able to execute Chrome and read standard install paths.

#!/usr/bin/env python3
# check_chrome_cve_2026_11151.py
# Detects whether Google Chrome is below 149.0.7827.53
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN

import os
import platform
import re
import shutil
import subprocess
import sys
from typing import Optional, Tuple

PATCH_FLOOR = (149, 0, 7827, 53)


def parse_version(text: str) -> Optional[Tuple[int, ...]]:
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def run_version(cmd):
    try:
        p = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True, timeout=10)
        if p.returncode == 0 or p.stdout:
            return p.stdout.strip()
    except Exception:
        pass
    return None


def candidate_commands():
    system = platform.system().lower()
    cmds = []

    if system == 'windows':
        paths = [
            os.path.join(os.environ.get('ProgramFiles', r'C:\Program Files'), 'Google', 'Chrome', 'Application', 'chrome.exe'),
            os.path.join(os.environ.get('ProgramFiles(x86)', r'C:\Program Files (x86)'), 'Google', 'Chrome', 'Application', 'chrome.exe'),
            os.path.join(os.environ.get('LocalAppData', ''), 'Google', 'Chrome', 'Application', 'chrome.exe'),
        ]
        for p in paths:
            if p and os.path.exists(p):
                cmds.append([p, '--version'])
    elif system == 'darwin':
        mac_path = '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'
        if os.path.exists(mac_path):
            cmds.append([mac_path, '--version'])
        user_mac_path = os.path.expanduser('~/Applications/Google Chrome.app/Contents/MacOS/Google Chrome')
        if os.path.exists(user_mac_path):
            cmds.append([user_mac_path, '--version'])
    else:
        for name in ['google-chrome', 'google-chrome-stable', '/usr/bin/google-chrome', '/opt/google/chrome/chrome']:
            resolved = shutil.which(name) if not name.startswith('/') else (name if os.path.exists(name) else None)
            if resolved:
                cmds.append([resolved, '--version'])

    return cmds


def main():
    seen = []
    for cmd in candidate_commands():
        out = run_version(cmd)
        if out:
            seen.append((cmd[0], out))
            ver = parse_version(out)
            if ver:
                if ver < PATCH_FLOOR:
                    print(f'VULNERABLE - {cmd[0]} reports version {".".join(map(str, ver))} which is below 149.0.7827.53')
                    sys.exit(1)
                else:
                    print(f'PATCHED - {cmd[0]} reports version {".".join(map(str, ver))} which is at or above 149.0.7827.53')
                    sys.exit(0)

    if seen:
        joined = '; '.join([f'{path}: {out}' for path, out in seen])
        print(f'UNKNOWN - Chrome was found but version parsing failed: {joined}')
    else:
        print('UNKNOWN - Google Chrome not found in standard install paths or PATH')
    sys.exit(2)


if __name__ == '__main__':
    main()

Sources

1. CIRCL Vulnerability Lookup: CVE-2026-11151
2. Google Chrome Releases: Stable Channel Update for Desktop
3. Chromium issue 501740323
4. CISA Known Exploited Vulnerabilities Catalog
5. FIRST EPSS FAQ
6. SecurityWeek: Chrome 149 Patches 429 Vulnerabilities
7. CERT-FR advisory on multiple Chrome vulnerabilities