Object lifecycle issue in Dawn in Google Chrome prior to 149

CVE-2026-11152 is an object-lifecycle bug in Dawn, Chromium’s WebGPU implementation. A crafted web page can hit vulnerable code paths and potentially cross the Chrome sandbox boundary. The affected range is Chrome before 149.0.7827.53; Google’s June 2, 2026 stable rollout shipped 149.0.7827.53 for Linux and 149.0.7827.53/54 for Windows and macOS, with Android inheriting the same desktop security fixes in 149.0.7827.59 unless otherwise noted.

The published 9.6/CRITICAL framing overstates what defenders should do with this in a 10,000-host fleet. Yes, sandbox escape from a malicious page is a big deal, but this path still needs user interaction, depends on WebGPU/Dawn reachability and compatible GPU acceleration, has no KEV entry or confirmed in-the-wild exploitation, and lacks a public weaponized PoC. That makes it a real HIGH, not a universal emergency.

Why this verdict

• Downgrade from 9.6: the chain starts with user interaction. That immediately removes the 'internet can hit it directly at scale' property that justifies true emergency-critical server bugs.
• Downgrade again: exploitation requires the Dawn/WebGPU path to be available. Chrome documentation shows WebGPU can be disabled by policy, unsupported hardware, blocklists, or disabled graphics acceleration, so the exposed population is smaller than 'every Chrome install.'
• Hold at HIGH, not MEDIUM: if the bug is reachable, the impact is still a sandbox escape from malicious web content, which is exactly the kind of browser boundary failure attackers prize for drive-by chains.
• No upward pressure from threat intel: no KEV, no public exploitation evidence, and a very low EPSS all argue against CRITICAL treatment right now.
• Enterprise blast radius is still broad enough for HIGH: Chrome is everywhere, and web content is constant. Even with feature gating, a browser sandbox escape can touch privileged sessions, SSO cookies, and admin workflows on many endpoints.

Why not higher?

It is not higher because the path is constrained by UI:R and feature/hardware reachability. There is also no current evidence of active exploitation or broad public weaponization, which is the normal trigger for moving browser bugs into patch-immediately territory.

Why not lower?

It is not lower because a browser sandbox escape is a meaningful security-boundary failure, not a cosmetic or tenant-contained bug. On a large enterprise fleet, even a partially reachable drive-by path is operationally important because the browser sits next to identity, SaaS sessions, internal apps, and admin consoles.

1. Force browser updates and relaunch — Push Chrome to 149.0.7827.53+ (149.0.7827.53/54+ on Windows/macOS) and enforce relaunch so the fixed code is actually loaded. For a HIGH verdict, deploy this under the noisgate mitigation window within 30 days, even if Chrome auto-update is already enabled.
2. Disable hardware acceleration for high-risk cohorts — For admins, finance, developers with production access, and browser-isolation exceptions, set Chrome policy HardwareAccelerationModeEnabled=false where business impact is acceptable. This reduces WebGPU/Dawn reachability and should be in place within 30 days for exposed high-value populations.
3. Route risky browsing through browser isolation — Put unmanaged internet browsing, webmail, ad-heavy content, and newly registered domains behind remote browser isolation or a hardened VDI profile. This cuts off the direct local exploit path and should be prioritized within 30 days for the riskiest user groups.
4. Tighten web delivery controls — Use safe browsing, DNS/web filtering, phishing-resistant mail controls, and URL detonation to reduce initial page-load opportunities. These controls do not fix the bug, but they materially reduce the volume of exploit attempts landing on vulnerable endpoints within 30 days.
5. Hunt for browser-origin post-exploitation — Add detections for unusual child processes from chrome.exe/Google Chrome, suspicious file writes after browsing sessions, and GPU-process crash clusters. Stand these detections up within 30 days to catch exploitation attempts before the full fleet is remediated.

Run this on the target endpoint or through your EDR/software-management agent. Invoke it as python3 check_cve_2026_11152.py or python3 check_cve_2026_11152.py --path "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome"; no admin rights are required unless your tooling restricts access to installed application paths.

#!/usr/bin/env python3
"""
Check local Google Chrome version against CVE-2026-11152 fixed build.
Outputs one of: VULNERABLE / PATCHED / UNKNOWN
Exit codes:
  0 = PATCHED
  1 = VULNERABLE
  2 = UNKNOWN / error
"""

import argparse
import os
import platform
import re
import shutil
import subprocess
import sys
from pathlib import Path

FIXED = (149, 0, 7827, 53)


def parse_version(text: str):
    m = re.search(r"(\d+)\.(\d+)\.(\d+)\.(\d+)", text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def cmp_ver(a, b):
    return (a > b) - (a < b)


def run_cmd(cmd):
    try:
        p = subprocess.run(cmd, capture_output=True, text=True, timeout=10)
        out = (p.stdout or "") + "\n" + (p.stderr or "")
        return p.returncode, out.strip()
    except Exception:
        return 99, ""


def candidate_paths(user_path=None):
    cands = []
    if user_path:
        cands.append(user_path)

    system = platform.system().lower()

    if system == "windows":
        local = os.environ.get("LOCALAPPDATA", "")
        pf = os.environ.get("PROGRAMFILES", "")
        pfx86 = os.environ.get("PROGRAMFILES(X86)", "")
        cands += [
            os.path.join(local, "Google", "Chrome", "Application", "chrome.exe"),
            os.path.join(pf, "Google", "Chrome", "Application", "chrome.exe"),
            os.path.join(pfx86, "Google", "Chrome", "Application", "chrome.exe"),
        ]
    elif system == "darwin":
        cands += [
            "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome",
            str(Path.home() / "Applications/Google Chrome.app/Contents/MacOS/Google Chrome"),
        ]
    else:
        cands += [
            shutil.which("google-chrome") or "",
            shutil.which("google-chrome-stable") or "",
            "/usr/bin/google-chrome",
            "/usr/bin/google-chrome-stable",
            "/opt/google/chrome/chrome",
        ]

    seen = set()
    uniq = []
    for c in cands:
        if c and c not in seen:
            uniq.append(c)
            seen.add(c)
    return uniq


def get_version_from_executable(path):
    if not path or not os.path.exists(path):
        return None
    rc, out = run_cmd([path, "--version"])
    ver = parse_version(out)
    if ver:
        return ver
    return None


def get_version_windows_registry():
    rc, out = run_cmd([
        "reg",
        "query",
        r"HKLM\Software\Google\Chrome\BLBeacon",
        "/v",
        "version",
    ])
    ver = parse_version(out)
    if ver:
        return ver
    rc, out = run_cmd([
        "reg",
        "query",
        r"HKCU\Software\Google\Chrome\BLBeacon",
        "/v",
        "version",
    ])
    ver = parse_version(out)
    return ver


def main():
    ap = argparse.ArgumentParser(description="Check if installed Google Chrome is vulnerable to CVE-2026-11152")
    ap.add_argument("--path", help="Explicit path to Chrome executable", default=None)
    args = ap.parse_args()

    ver = None
    source = None

    if platform.system().lower() == "windows":
        ver = get_version_windows_registry()
        if ver:
            source = "registry"

    if not ver:
        for cand in candidate_paths(args.path):
            ver = get_version_from_executable(cand)
            if ver:
                source = cand
                break

    if not ver:
        print("UNKNOWN - Google Chrome version not found")
        sys.exit(2)

    if cmp_ver(ver, FIXED) < 0:
        print(f"VULNERABLE - Chrome version {'.'.join(map(str, ver))} detected via {source}; fixed is {'.'.join(map(str, FIXED))}+")
        sys.exit(1)
    else:
        print(f"PATCHED - Chrome version {'.'.join(map(str, ver))} detected via {source}; meets fixed baseline {'.'.join(map(str, FIXED))}+")
        sys.exit(0)


if __name__ == "__main__":
    main()

Sources

1. Chrome Releases: Stable Channel Update for Desktop (Chrome 149)
2. Chromium issue 501762953
3. CIRCL Vulnerability Lookup for CVE-2026-11152
4. Chrome for Developers: WebGPU Overview
5. Chrome for Developers: WebGPU troubleshooting tips
6. Dawn README
7. CISA Known Exploited Vulnerabilities Catalog
8. FIRST EPSS API