Out of bounds read in Input in Google Chrome on Linux prior to 149

CVE-2026-11160 is an out-of-bounds read in Chrome's Input component on Linux only. A user running Google Chrome prior to 149.0.7827.53 can be induced to load a crafted HTML page, which may leak data from process memory. The stated impact is confidentiality only: no integrity loss, no availability loss, and no stated sandbox escape or code execution path.

Google's MEDIUM 6.5 baseline is broadly fair, but in enterprise reality this lands a bit lower. The biggest downward pressures are: user interaction is mandatory, the affected population is only Linux Chrome, and the impact is an information disclosure rather than code execution. That still matters for browser fleets, but it is not the kind of Chrome bug that should blow up your patch board unless you have a large Linux desktop or developer population.

Why this verdict

• UI-required drops urgency: the attacker needs the victim to browse to hostile content, which moves this out of wormable/server-side territory immediately.
• Linux-only population narrows exposure: most enterprises have a materially smaller Linux desktop/browser estate than Windows, so the exploitable population is usually a minority slice of endpoints.
• Confidentiality-only impact constrains blast radius: this is not stated RCE, sandbox escape, or persistence. The attacker is fishing for process memory, not taking the box.

Why not higher?

There is no KEV listing, no public exploitation evidence, and no public PoC located. More importantly, the chain stops at a memory disclosure on Linux Chrome and still needs a user to render hostile content, which is a meaningful friction stack for enterprise prioritization.

Why not lower?

It is still a remote browser bug against one of the most routinely attacked client surfaces in the enterprise. No authentication is needed, a crafted page is enough to reach the vulnerable code path, and sensitive browser-process memory can still be valuable in targeted operations.

1. Keep Linux browser auto-update healthy — Make sure Google Chrome update channels on Linux are functioning and not pinned behind stale repos or broken package policies. For a MEDIUM verdict there is no mitigation SLA — go straight to the 365-day remediation window, but browser updates should still ride your normal endpoint-update cadence rather than waiting for annual backlog cleanup.
2. Reduce untrusted web exposure — Use secure web gateways, DNS filtering, and browser isolation for high-risk user groups to cut off the malicious-page prerequisite. This matters most before the patched build is broadly deployed; for a MEDIUM verdict there is no separate mitigation SLA, so implement through standing controls and normal policy tuning.
3. Prioritize Linux developer and admin workstations — If you have a small Linux fleet, the likely highest-risk subset is developers, admins, and research users who browse broadly and hold valuable tokens or internal app access in-browser. Move those systems to the front of the normal browser update ring even though this CVE does not justify emergency fleet disruption.

Run this on the target Linux host or through your endpoint management agent. Invoke it as bash check-chrome-cve-2026-11160.sh; no root is required if the Chrome/Chromium binary is on PATH, though package-manager fallback checks may work better with standard local package visibility.

#!/usr/bin/env bash
# check-chrome-cve-2026-11160.sh
# Determine whether a Linux host is vulnerable to CVE-2026-11160
# Affected: Google Chrome on Linux prior to 149.0.7827.53
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

FIXED_VERSION="149.0.7827.53"
FOUND_NAME=""
FOUND_VERSION=""

get_bin_version() {
  local bin="$1"
  if command -v "$bin" >/dev/null 2>&1; then
    local out
    out="$($bin --version 2>/dev/null || true)"
    echo "$out" | grep -Eo '[0-9]+(\.[0-9]+){3}' | head -n1
    return 0
  fi
  return 1
}

# Compare dotted versions: returns
# 0 if equal, 1 if first > second, 2 if first < second
vercomp() {
  local IFS=.
  local i
  local -a va=($1) vb=($2)
  local len=${#va[@]}
  if [ ${#vb[@]} -gt $len ]; then
    len=${#vb[@]}
  fi
  for ((i=0; i<len; i++)); do
    local a=${va[i]:-0}
    local b=${vb[i]:-0}
    if ((10#$a > 10#$b)); then
      return 1
    fi
    if ((10#$a < 10#$b)); then
      return 2
    fi
  done
  return 0
}

check_pkg_mgr() {
  local v=""
  if command -v dpkg-query >/dev/null 2>&1; then
    for pkg in google-chrome-stable google-chrome chromium-browser chromium; do
      v=$(dpkg-query -W -f='${Version}\n' "$pkg" 2>/dev/null | grep -Eo '[0-9]+(\.[0-9]+){3}' | head -n1)
      if [ -n "$v" ]; then
        FOUND_NAME="$pkg"
        FOUND_VERSION="$v"
        return 0
      fi
    done
  fi
  if command -v rpm >/dev/null 2>&1; then
    for pkg in google-chrome-stable google-chrome chromium-browser chromium; do
      v=$(rpm -q --qf '%{VERSION}\n' "$pkg" 2>/dev/null | grep -Eo '[0-9]+(\.[0-9]+){3}' | head -n1)
      if [ -n "$v" ]; then
        FOUND_NAME="$pkg"
        FOUND_VERSION="$v"
        return 0
      fi
    done
  fi
  return 1
}

for candidate in google-chrome-stable google-chrome chromium-browser chromium; do
  ver=$(get_bin_version "$candidate" || true)
  if [ -n "${ver:-}" ]; then
    FOUND_NAME="$candidate"
    FOUND_VERSION="$ver"
    break
  fi
done

if [ -z "$FOUND_VERSION" ]; then
  check_pkg_mgr || true
fi

if [ -z "$FOUND_VERSION" ]; then
  echo "UNKNOWN - no Chrome/Chromium binary or package version found"
  exit 2
fi

vercomp "$FOUND_VERSION" "$FIXED_VERSION"
rc=$?
case $rc in
  2)
    echo "VULNERABLE - $FOUND_NAME version $FOUND_VERSION is older than fixed $FIXED_VERSION"
    exit 1
    ;;
  0|1)
    echo "PATCHED - $FOUND_NAME version $FOUND_VERSION is at or newer than fixed $FIXED_VERSION"
    exit 0
    ;;
  *)
    echo "UNKNOWN - unable to compare versions"
    exit 2
    ;;
esac

Sources

1. Chrome Releases - Stable Channel Update for Desktop
2. Chrome Releases - 2026 archive entry showing CVE-2026-11160
3. Chromium issue tracker reference
4. CISA Known Exploited Vulnerabilities Catalog
5. FIRST EPSS API query for this CVE
6. NVD record
7. Quanteta CVE tracker listing