Inappropriate implementation in CSS in Google Chrome prior to 149

CVE-2026-11156 is a Chrome CSS implementation flaw that lets a remote attacker use a crafted web page to leak *some* cross-origin data from the victim's browser. The affected range is Google Chrome versions *before* 149.0.7827.53; Google pushed the fix in the 149.0.7827.53/.54 early-stable train for desktop, with broader stable rollout following Chrome's normal channel cadence.

Google's MEDIUM 4.3 rating is technically fair in a vacuum, but for enterprise patch triage it's still a *downward-pressure* case: the attacker needs user interaction, the impact is confidentiality-only, the leak is constrained to what can be inferred from browser-side rendering behavior, and this is not an internet-facing server foothold. On a 10,000-host patch board, this is a browser hygiene item, not a fire drill.

Why this verdict

• UI:R is real downward pressure: the attacker needs the victim to render attacker-controlled web content, which implies phishing, malvertising, or a compromised site instead of direct unauthenticated exploitation.
• Browser-context only: even if successful, this leaks cross-origin data from the victim's session; it does not deliver code execution, persistence, lateral movement, or server-side footholds by itself.
• Low-value exploit market signal: the supplied EPSS is extremely low and CISA KEV is empty, which lines up with a bug that defenders should patch but not overreact to.
• Exposure is broad but shallow: Chrome is everywhere, but this kind of flaw is gated by click-through, target app state, and whether the page can extract anything useful at all.

Why not higher?

There is no evidence here of code execution, sandbox escape, privilege escalation, or active exploitation. The attack also compounds multiple frictions: user interaction, victim browser context, and the need for a leakable cross-origin target state, which sharply reduces operational usefulness compared with real intrusion-grade Chrome bugs.

Why not lower?

It is still a remotely triggerable browser flaw in a massively deployed product, and a successful attacker may be able to steal sensitive cross-origin state from authenticated sessions. If your users spend all day in high-value SaaS apps, even a low-bandwidth leak can matter, so this should not be ignored outright.

1. Enforce auto-update — Make sure managed Chrome updates are not deferred unnecessarily and that endpoints converge on 149.0.7827.53+ through your normal browser maintenance motion. For a LOW verdict there is no fixed mitigation SLA; treat this as backlog hygiene and complete it in the normal browser update cycle.
2. Block stale browser versions — Use device compliance, EDR posture, NAC, or browser management to identify and restrict endpoints that remain on old Chrome builds. This cuts the long tail of exception machines that keep client-side browser bugs alive.
3. Harden web delivery paths — Keep secure web gateway, DNS filtering, and email link protection tuned for lure domains and newly registered infrastructure. These controls matter here because the exploit path starts with getting the user to a hostile page.
4. Isolate high-risk browsing — For privileged admins and users handling sensitive internal apps, use browser isolation or stricter outbound browsing policy where practical. It reduces the value of browser-side data leak bugs even when patching lags.

Run this on the target endpoint or through your software inventory/remote execution tooling. Invoke it with python3 check_chrome_cve_2026_11156.py on Windows, macOS, or Linux; standard user rights are usually enough because it only reads version info from common install paths and the Windows registry.

#!/usr/bin/env python3
# check_chrome_cve_2026_11156.py
# Detects whether installed Google Chrome is older than 149.0.7827.53
# Outputs one of: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import subprocess
import sys

THRESHOLD = (149, 0, 7827, 53)


def parse_version(text):
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def run_cmd(cmd):
    try:
        p = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, timeout=10)
        out = (p.stdout or '') + '\n' + (p.stderr or '')
        return out.strip()
    except Exception:
        return ''


def windows_version():
    cmds = [
        ['reg', 'query', r'HKLM\SOFTWARE\Google\Chrome\BLBeacon', '/v', 'version'],
        ['reg', 'query', r'HKLM\SOFTWARE\WOW6432Node\Google\Chrome\BLBeacon', '/v', 'version'],
        ['reg', 'query', r'HKCU\Software\Google\Chrome\BLBeacon', '/v', 'version'],
    ]
    for cmd in cmds:
        out = run_cmd(cmd)
        v = parse_version(out)
        if v:
            return v, out
    return None, ''


def mac_version():
    candidates = [
        '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
        os.path.expanduser('~/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'),
    ]
    for path in candidates:
        if os.path.exists(path):
            out = run_cmd([path, '--version'])
            v = parse_version(out)
            if v:
                return v, out
    return None, ''


def linux_version():
    candidates = [
        ['google-chrome', '--version'],
        ['google-chrome-stable', '--version'],
        ['chrome', '--version'],
    ]
    for cmd in candidates:
        out = run_cmd(cmd)
        v = parse_version(out)
        if v:
            return v, out
    return None, ''


def compare_versions(a, b):
    return (a > b) - (a < b)


def main():
    system = platform.system().lower()
    version = None
    raw = ''

    if 'windows' in system:
        version, raw = windows_version()
    elif 'darwin' in system:
        version, raw = mac_version()
    elif 'linux' in system:
        version, raw = linux_version()
    else:
        print('UNKNOWN')
        print('Unsupported platform: {}'.format(platform.system()))
        sys.exit(2)

    if not version:
        print('UNKNOWN')
        print('Google Chrome version not found')
        sys.exit(2)

    if compare_versions(version, THRESHOLD) < 0:
        print('VULNERABLE')
        print('Detected Chrome version {} from: {}'.format('.'.join(map(str, version)), raw))
        sys.exit(1)
    else:
        print('PATCHED')
        print('Detected Chrome version {} from: {}'.format('.'.join(map(str, version)), raw))
        sys.exit(0)


if __name__ == '__main__':
    main()

Sources

1. NVD CVE-2026-11156
2. Chrome Releases: Early Stable Update for Desktop
3. Chromium issue 501810226
4. CISA Known Exploited Vulnerabilities Catalog
5. FIRST EPSS data stats
6. FIRST EPSS FAQ
7. FIRST EPSS API documentation
8. Chrome Enterprise release notes / previous release notes