Inappropriate implementation in DataTransfer in Google Chrome prior to 149

CVE-2026-11161 is a Chrome client-side information disclosure bug in DataTransfer handling. Affected builds are Chrome versions earlier than 149.0.7827.53 on Linux and earlier than 149.0.7827.53/.54 on Windows and macOS, with the practical fixed floor for enterprises being 149.0.7827.53 or later. The stated impact is cross-origin data leakage through a crafted HTML page, which means the attacker is abusing browser trust boundaries to read data they should not get, not executing code on the endpoint.

Google's MEDIUM 4.3 label is basically fair in the real world. The bug is remotely reachable through web content and Chrome is everywhere, but the chain still needs a user to hit attacker-controlled content, the impact is confidentiality-only and rated low, and there is no evidence in the sources reviewed of KEV listing, public exploitation, or a commodity exploit kit path. For a 10,000-host fleet, this belongs in your normal browser update machinery, not in your emergency patch lane.

Why this verdict

• Started from the vendor's 4.3 MEDIUM baseline because the stated impact is cross-origin data disclosure, not code execution or sandbox escape.
• User interaction is mandatory: the supplied vector is UI:R, which means the attacker still needs delivery plus victim engagement with attacker-controlled content. That materially narrows reliable exploitation in enterprise fleets.
• This is post-browse, not infrastructure-reachable: there is no exposed daemon, service port, or server workload to scan and mass-weaponize. The attacker only gets a shot when a vulnerable user browser hits their content.
• No active exploitation signal: no KEV listing, no public exploitation evidence, and a supplied EPSS of 0.00012 all argue against emergency reprioritization upward.
• Blast radius is per-user session context: even if exploited, the expected outcome is data leakage from browser context, not direct host takeover across the fleet.

Why not higher?

There is no evidence in the reviewed sources of active exploitation, no public PoC surfaced, and the impact is not RCE or sandbox escape. The prerequisite chain compounds downward pressure: remote delivery still depends on user interaction and useful data being present in the browser at the time.

Why not lower?

Chrome is one of the most exposed client applications in any enterprise, so even a confidentiality-only browser boundary bug deserves attention. Same-origin and cross-origin leaks can become real account and data exposure when they intersect with live SaaS sessions, internal portals, or privileged admin browsing.

1. Verify Chrome auto-update health — Check for version pinning, disabled updates, stale relaunch debt, and broken update rings. For a MEDIUM verdict there is no mitigation SLA; use this as normal hygiene while you drive to the patch under the 365-day remediation window.
2. Prioritize risky user groups — Move admins, finance, help desk, and users with broad SaaS access to the patched build first because browser-session exposure is where this bug pays off for attackers. Again, there is no mitigation SLA for MEDIUM, so do this as part of normal rollout acceleration rather than emergency change control.
3. Tighten web egress and filtering — Keep Safe Browsing, secure web gateway policies, DNS filtering, and attachment detonation tuned to reduce the odds that users ever reach malicious lure pages. This lowers exploit reach while patch adoption completes within the remediation window.
4. Watch identity and SaaS logs — Because the likely business impact is downstream session or data abuse, monitor impossible travel, token anomalies, new device enrollments, and sensitive data exports from key apps. This is more useful than waiting for endpoint security to name the CVE.

Run this on the target endpoint or through your software inventory agent. Invoke it as python3 check_chrome_cve_2026_11161.py on macOS/Linux or py check_chrome_cve_2026_11161.py on Windows; no admin rights are required if Chrome is installed in standard locations. The script checks common Chrome paths and prints VULNERABLE, PATCHED, or UNKNOWN.

#!/usr/bin/env python3
# check_chrome_cve_2026_11161.py
# Determine whether installed Google Chrome is below 149.0.7827.53
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import shutil
import subprocess
import sys
from typing import Optional, Tuple

FIXED = (149, 0, 7827, 53)


def parse_version(text: str) -> Optional[Tuple[int, ...]]:
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def run_cmd(cmd):
    try:
        p = subprocess.run(cmd, capture_output=True, text=True, timeout=10)
        out = (p.stdout or '') + '\n' + (p.stderr or '')
        return p.returncode, out.strip()
    except Exception:
        return 999, ''


def candidate_commands():
    system = platform.system().lower()
    cmds = []

    if system == 'windows':
        local = os.environ.get('LOCALAPPDATA', r'C:\Users\Default\AppData\Local')
        pf = os.environ.get('PROGRAMFILES', r'C:\Program Files')
        pfx86 = os.environ.get('PROGRAMFILES(X86)', r'C:\Program Files (x86)')
        candidates = [
            os.path.join(local, 'Google', 'Chrome', 'Application', 'chrome.exe'),
            os.path.join(pf, 'Google', 'Chrome', 'Application', 'chrome.exe'),
            os.path.join(pfx86, 'Google', 'Chrome', 'Application', 'chrome.exe'),
        ]
        for c in candidates:
            cmds.append([c, '--version'])
        cmds.append(['reg', 'query', r'HKLM\Software\Google\Chrome\BLBeacon', '/v', 'version'])
        cmds.append(['reg', 'query', r'HKCU\Software\Google\Chrome\BLBeacon', '/v', 'version'])

    elif system == 'darwin':
        candidates = [
            '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
            os.path.expanduser('~/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'),
        ]
        for c in candidates:
            cmds.append([c, '--version'])
        which = shutil.which('google-chrome')
        if which:
            cmds.append([which, '--version'])

    else:
        bins = [
            'google-chrome', 'google-chrome-stable', 'chrome', 'chromium', 'chromium-browser'
        ]
        for b in bins:
            which = shutil.which(b)
            if which:
                cmds.append([which, '--version'])
        candidates = [
            '/opt/google/chrome/chrome',
            '/usr/bin/google-chrome',
            '/usr/bin/google-chrome-stable',
        ]
        for c in candidates:
            cmds.append([c, '--version'])

    return cmds


def find_version() -> Optional[Tuple[int, ...]]:
    seen = set()
    for cmd in candidate_commands():
        key = tuple(cmd)
        if key in seen:
            continue
        seen.add(key)
        rc, out = run_cmd(cmd)
        ver = parse_version(out)
        if ver:
            return ver
    return None


def cmp_ver(a, b):
    # Normalize length if needed
    maxlen = max(len(a), len(b))
    aa = a + (0,) * (maxlen - len(a))
    bb = b + (0,) * (maxlen - len(b))
    if aa < bb:
        return -1
    if aa > bb:
        return 1
    return 0


def main():
    ver = find_version()
    if not ver:
        print('UNKNOWN: Google Chrome version not found in standard locations')
        sys.exit(2)

    ver_str = '.'.join(str(x) for x in ver)
    fixed_str = '.'.join(str(x) for x in FIXED)

    if cmp_ver(ver, FIXED) < 0:
        print(f'VULNERABLE: installed Chrome version {ver_str} is older than fixed {fixed_str}')
        sys.exit(1)
    else:
        print(f'PATCHED: installed Chrome version {ver_str} is at or above fixed {fixed_str}')
        sys.exit(0)


if __name__ == '__main__':
    main()

Sources

1. Chrome Releases: Early Stable Update for Desktop (149.0.7827.53/.54)
2. Chrome Releases homepage
3. Canadian Centre for Cyber Security advisory AV26-544
4. Vulnerability-Lookup Chrome June 2026 entries
5. CISA Known Exploited Vulnerabilities Catalog
6. FIRST EPSS API documentation
7. Chrome Enterprise auto-update policies
8. Chrome Enterprise update management guidance