Side-channel information leakage in Forms in Google Chrome prior to 149

CVE-2026-11153 is a side-channel information leak in Chrome Forms handling that affects Google Chrome versions earlier than 149.0.7827.53. A malicious page can abuse browser behavior to infer cross-origin data that should stay behind same-origin boundaries. The affected range is broad in the usual browser sense—any desktop Chrome build below the fixed release—with corresponding Android security fixes shipped in Chrome 149.0.7827.59.

The vendor-supplied 9.1/CRITICAL framing overstates the operational risk for enterprise patch triage. This is still a browser bug and Chrome is everywhere, but the real-world path is *user-driven web content to data leakage*, not *unauthenticated server-side compromise* and not *remote code execution on the endpoint*. Google’s own CNA text embeds Chromium security severity: Medium, which fits reality much better than the CVSS label.

Why this verdict

• Start from the browser ubiquity baseline: Chrome is massively deployed and attacker-reachable through ordinary web traffic, so the vendor baseline is not crazy *in abstract*.
• First explicit downgrade — attacker position is really browser-content execution: the CVSS says UI:N, but the practical prerequisite is getting a user to render a malicious page or ad. That is weaker than a passive network-reachable service bug and narrows real exposure immediately.
• Second explicit downgrade — post-render, not post-host: successful exploitation leaks cross-origin browser data; it does not directly give shell, persistence, or sandbox escape on the endpoint. The blast radius is usually bounded to the victim session and the sites the victim is signed into.
• Third explicit downgrade — exploit economics are poor right now: no KEV entry, no public PoC found, and EPSS 0.00035 all point to low observed attacker pressure.
• Why it stays at MEDIUM instead of LOW: browsers are one of the few clients attackers can hit at scale, and same-origin boundary erosion can still matter for SSO-heavy enterprises and admin workflows.

Why not higher?

There is no evidence here of renderer compromise, sandbox escape, or host-level code execution. The chain also depends on user browsing plus a valuable authenticated browser context, which is materially more constrained than a true unauthenticated remote service exploit.

Why not lower?

Chrome is everywhere, and getting victims to render malicious web content is not hard. A same-origin boundary leak against users already logged into sensitive SaaS or internal web apps can still produce real business impact even without code execution.

1. Enforce Chrome auto-update — Make sure enterprise policy is not pinning outdated Chrome builds and that update deferrals are short. For a MEDIUM verdict there is no mitigation SLA — go straight to the 365-day remediation window, but browsers should normally move much faster than that through standard endpoint management.
2. Prioritize high-risk user rings — Push fixed Chrome builds first to admins, finance, help desk, and users with access to sensitive SaaS consoles, since browser-session leakage hurts most when the victim is already authenticated. For MEDIUM, there is no mitigation SLA — go straight to the 365-day remediation window; use that window to clean up stragglers while fast-tracking high-value populations operationally.
3. Use remote browser isolation for risky browsing paths — If you already have RBI or equivalent web isolation, route untrusted links, email-click traffic, and unknown domains through it. This is a sensible exposure reducer while you patch, but for MEDIUM there is no mitigation SLA — go straight to the 365-day remediation window.
4. Inventory browser versions continuously — Treat this as an endpoint software inventory problem, not a perimeter scan problem. Query EDR, MDM, or browser management to find devices below 149.0.7827.53; for MEDIUM, there is no mitigation SLA — go straight to the 365-day remediation window.

Run this on the target endpoint or through EDR live response, not from an auditor workstation. Invoke it as python3 check_chrome_cve_2026_11153.py on macOS/Linux or py check_chrome_cve_2026_11153.py on Windows; no admin rights are normally required. It checks locally installed Chrome versions and prints VULNERABLE, PATCHED, or UNKNOWN.

#!/usr/bin/env python3
# check_chrome_cve_2026_11153.py
# Detects whether locally installed Google Chrome is below 149.0.7827.53
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import subprocess
import sys
from shutil import which

THRESHOLD = (149, 0, 7827, 53)


def parse_version(text):
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def cmp_ver(a, b):
    return (a > b) - (a < b)


def get_windows_version():
    candidates = [
        r"C:\Program Files\Google\Chrome\Application\chrome.exe",
        r"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe",
        os.path.expandvars(r"%LOCALAPPDATA%\Google\Chrome\Application\chrome.exe"),
    ]
    for path in candidates:
        if path and os.path.exists(path):
            try:
                cmd = [
                    'powershell', '-NoProfile', '-Command',
                    f"(Get-Item '{path}').VersionInfo.ProductVersion"
                ]
                out = subprocess.check_output(cmd, stderr=subprocess.DEVNULL, text=True, timeout=10).strip()
                ver = parse_version(out)
                if ver:
                    return path, ver
            except Exception:
                continue
    return None, None


def get_macos_version():
    candidates = [
        "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome",
        os.path.expanduser("~/Applications/Google Chrome.app/Contents/MacOS/Google Chrome"),
    ]
    for path in candidates:
        if os.path.exists(path):
            try:
                out = subprocess.check_output([path, '--version'], stderr=subprocess.DEVNULL, text=True, timeout=10).strip()
                ver = parse_version(out)
                if ver:
                    return path, ver
            except Exception:
                continue
    return None, None


def get_linux_version():
    candidates = [
        which('google-chrome'),
        which('google-chrome-stable'),
        '/opt/google/chrome/chrome',
        '/usr/bin/google-chrome',
        '/usr/bin/google-chrome-stable',
    ]
    seen = set()
    for path in candidates:
        if not path or path in seen:
            continue
        seen.add(path)
        if os.path.exists(path):
            try:
                out = subprocess.check_output([path, '--version'], stderr=subprocess.DEVNULL, text=True, timeout=10).strip()
                ver = parse_version(out)
                if ver:
                    return path, ver
            except Exception:
                continue
    return None, None


def main():
    system = platform.system().lower()
    if 'windows' in system:
        path, ver = get_windows_version()
    elif 'darwin' in system:
        path, ver = get_macos_version()
    elif 'linux' in system:
        path, ver = get_linux_version()
    else:
        print('UNKNOWN: unsupported OS for this checker')
        sys.exit(2)

    if not ver:
        print('UNKNOWN: Google Chrome not found or version unreadable')
        sys.exit(2)

    installed = '.'.join(map(str, ver))
    fixed = '.'.join(map(str, THRESHOLD))

    if cmp_ver(ver, THRESHOLD) < 0:
        print(f'VULNERABLE: Chrome {installed} found at {path}; fixed version is {fixed} or later')
        sys.exit(1)
    else:
        print(f'PATCHED: Chrome {installed} found at {path}; meets fixed version {fixed} or later')
        sys.exit(0)


if __name__ == '__main__':
    main()

Sources

1. Chrome CNA / CVE record mirror with references and metadata
2. Chrome Stable Channel Update for Desktop
3. Chrome Early Stable Update for Desktop
4. Chrome for Android Update
5. Chromium issue reference 501779840
6. CISA Known Exploited Vulnerabilities Catalog
7. FIRST EPSS model documentation
8. FIRST EPSS API documentation