Inappropriate implementation in CSS in Google Chrome prior to 149

CVE-2026-11162 affects Google Chrome before 149.0.7827.53 on Linux and before 149.0.7827.53/.54 on Windows and macOS. The practical issue is a malicious web page abusing a CSS-side policy mistake to infer or leak cross-origin data from another origin already open or reachable in the victim's browser context. One wrinkle: Google's June 2, 2026 stable release notes label this CVE as "Insufficient policy enforcement in CSS", while some downstream CVE mirrors describe it as "Inappropriate implementation in CSS".

Google calling this MEDIUM is basically right. The bug is reachable over the web and Chrome's deployment footprint is huge, but the attacker still needs a user to render hostile content and the impact described is limited to confidentiality leakage, not code execution, persistence, or host compromise. The real risk driver is stolen browser-session data from SaaS or internal apps, not a beachhead on the endpoint.

Why this verdict

• Start from vendor 4.3: Google's baseline is sane because the published impact is low-grade cross-origin data exposure with UI:R, not code exec.
• Downward pressure from attacker position: the chain begins with a user loading hostile content in a vulnerable browser. That implies phishing, malvertising, or prior traffic control rather than direct unauthenticated remote exploitation of enterprise infrastructure.
• Downward pressure from blast radius: exploitation stays inside the victim's browser/session context. Even with a successful leak, this is usually user- or app-scoped rather than domain-wide or host-wide compromise.
• Upward pressure from exposure population: Chrome is massively deployed, so even a medium browser bug can hit a lot of endpoints if update hygiene is poor.
• Net adjustment: ubiquity nudges the score slightly up from a sterile lab view, but lack of KEV, no public PoC signal, and no integrity/availability impact keep it firmly in MEDIUM.

Why not higher?

There is no evidence of active exploitation, no KEV listing, and no public signal that this is being mass-weaponized. More importantly, the published impact is a data leak with user interaction required; that is materially less urgent than a no-click RCE, sandbox escape, or auth bypass on an enterprise platform.

Why not lower?

This is not harmless. A browser-side cross-origin leak can expose sensitive application data from already-authenticated enterprise users, and Chrome's footprint means the reachable population is large. If your fleet has stale browsers or privileged admins browsing broadly, the business impact is real enough to stay above LOW.

1. Enforce Chrome auto-update health — Use enterprise browser management to ensure Chrome actually advances to 149.0.7827.53+ and that relaunch deadlines are working. For a MEDIUM verdict there is no mitigation SLA, so use this as an operational accelerator while staying inside the <=365 day remediation window.
2. Harden web delivery controls — Keep Safe Browsing, email URL detonation, DNS/web filtering, and browser reputation controls enabled because they attack the delivery step that this bug depends on. There is no mitigation SLA for MEDIUM, but these controls should remain continuously enforced while you remediate within <=365 days.
3. Isolate privileged browsing — Route admins, finance, and IdP-heavy users through browser isolation or stricter application control where feasible. This is the best temporary risk reducer because the value of this CVE rises sharply when the user has high-value active sessions; again, no mitigation SLA applies, so use it selectively while patching in the <=365 day window.
4. Inventory stranded Chrome channels — Find VDI images, kiosk builds, offline laptops, and unmanaged local installs that miss normal browser servicing. Those long-tail systems are where a medium browser bug becomes persistent backlog debt; close them during the <=365 day remediation period.

Run this on the target endpoint or via your EDR/remote execution platform. Invoke with python3 check_chrome_cve_2026_11162.py on macOS/Linux or py check_chrome_cve_2026_11162.py on Windows; no admin rights are required, but the script must be able to execute the local Chrome binary or read its version from common install paths.

#!/usr/bin/env python3
# check_chrome_cve_2026_11162.py
# Checks whether local Google Chrome is below the fixed version for CVE-2026-11162.
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import shutil
import subprocess
import sys
from typing import Optional, Tuple

FIXED_LINUX = (149, 0, 7827, 53)
FIXED_WIN_MAC = (149, 0, 7827, 53)  # Accept .53 or later; advisory notes Windows/Mac .53/.54


def parse_version(text: str) -> Optional[Tuple[int, int, int, int]]:
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def run_version(cmd):
    try:
        p = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, timeout=8)
        out = (p.stdout or '') + ' ' + (p.stderr or '')
        return parse_version(out)
    except Exception:
        return None


def candidate_paths():
    system = platform.system().lower()
    paths = []
    if system == 'windows':
        envs = [os.environ.get('ProgramFiles'), os.environ.get('ProgramFiles(x86)'), os.environ.get('LocalAppData')]
        for base in envs:
            if not base:
                continue
            paths.append(os.path.join(base, 'Google', 'Chrome', 'Application', 'chrome.exe'))
    elif system == 'darwin':
        paths.extend([
            '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
            os.path.expanduser('~/Applications/Google Chrome.app/Contents/MacOS/Google Chrome')
        ])
    else:
        for name in ['google-chrome', 'google-chrome-stable', 'chromium', 'chromium-browser']:
            resolved = shutil.which(name)
            if resolved:
                paths.append(resolved)
        paths.extend([
            '/usr/bin/google-chrome',
            '/usr/bin/google-chrome-stable',
            '/opt/google/chrome/chrome'
        ])
    return paths


def get_local_version() -> Optional[Tuple[int, int, int, int]]:
    for path in candidate_paths():
        if os.path.exists(path) or shutil.which(path):
            v = run_version([path, '--version'])
            if v:
                return v
    return None


def compare(v1, v2):
    return (v1 > v2) - (v1 < v2)


def main():
    system = platform.system().lower()
    version = get_local_version()

    if not version:
        print('UNKNOWN: Could not determine local Chrome version')
        sys.exit(2)

    fixed = FIXED_WIN_MAC if system in ('windows', 'darwin') else FIXED_LINUX

    if compare(version, fixed) < 0:
        print(f'VULNERABLE: Detected Chrome version {".".join(map(str, version))} < fixed {".".join(map(str, fixed))}')
        sys.exit(1)
    else:
        print(f'PATCHED: Detected Chrome version {".".join(map(str, version))} >= fixed {".".join(map(str, fixed))}')
        sys.exit(0)


if __name__ == '__main__':
    main()

Sources

1. Google Chrome Releases - Stable Channel Update for Desktop (June 2, 2026)
2. Chrome Releases - June 2026 archive
3. Chromium Security page
4. FIRST EPSS API documentation
5. FIRST EPSS data and statistics
6. CISA Known Exploited Vulnerabilities Catalog
7. Statcounter desktop browser market share worldwide
8. Google Chrome update guidance