Inappropriate implementation in SVG in Google Chrome prior to 149

CVE-2026-11166 is an SVG handling flaw in Google Chrome that can let a remote attacker inject arbitrary script or HTML in the browser context, i.e. a UXSS-style outcome, when a user renders attacker-controlled content. Based on Google's June 2, 2026 desktop stable rollout, the affected population is Chrome versions before 149.0.7827.53 on Linux and before 149.0.7827.53/54 on Windows and macOS.

Google rated it MEDIUM at 6.8, and that is broadly the right bucket, but the raw score is a little generous for enterprise prioritization. The attack still needs a user to open or render hostile content, the vendor vector already admits AC:H and UI:R, there is no KEV listing or public exploitation evidence, and the likely business impact is stolen web session data or action-on-behalf-of-user in the browser rather than durable host takeover.

Why this verdict

• Downward pressure: UI:R means every attack starts with a click or render event; that implies phishing, web delivery, or content-hosting success before the vulnerability even matters.
• Further downward pressure: AC:H is not decorative; it says the parser or browser state requirement is fussy enough that most opportunistic actors will prefer easier Chrome bugs.
• Further downward pressure: this is a client-side browser flaw, not exposed infrastructure; reach is limited to users who both run the vulnerable build and can be induced to load the hostile SVG.
• Further downward pressure: no KEV, no public exploitation evidence, and no visible public PoC; that materially lowers immediate weaponization pressure for a 10,000-host enterprise.
• Upward pressure: Chrome is everywhere and UXSS against an authenticated user can still be high-value; stolen SaaS data, token abuse, and action-on-behalf-of-user are real business impacts even without native code execution.

Why not higher?

It is not higher because the chain narrows quickly in the real world: remote delivery still needs user interaction, exploit success still needs a high-complexity condition, and the impact is primarily in-browser. There is also no current evidence of active exploitation, no KEV listing, and no public exploit ecosystem pushing this into urgent defender panic territory.

Why not lower?

It is not lower because a successful UXSS event in Chrome can directly compromise the confidentiality and integrity of active business web sessions. In enterprises that live inside SaaS, that can still translate into data theft, fraudulent transactions, or trusted-user lateral phishing.

1. Force browser auto-update compliance — Make sure managed Chrome update policy is actually landing on endpoints and that stale channels are not pinned indefinitely. For a MEDIUM verdict there is no noisgate mitigation SLA — go straight to the 365-day remediation window, but browsers should ride your normal fast client-update motion rather than wait for annual backlog cleanup.
2. Restrict untrusted SVG handling — Block or warn on externally sourced .svg attachments and downloads in mail, chat, and secure web gateway controls where business use allows it. This cuts the most likely delivery path while patching proceeds; there is no noisgate mitigation SLA for this verdict, so use it as a risk reducer during the remediation window.
3. Isolate high-risk browsing — Put privileged admins, finance users, and help desk staff behind browser isolation or hardened browsing profiles for untrusted sites. This is especially useful where users routinely open externally shared design assets or documents that may embed SVG content.
4. Harden SaaS session controls — Shorten token lifetime where practical, require re-auth for sensitive actions, and tune IdP/CASB anomaly detection for unusual in-session behavior. It will not stop the browser bug itself, but it reduces the payoff if UXSS lands.

Run this on the target endpoint itself or through your fleet-management agent. Invoke it as python3 check_cve_2026_11166.py on macOS/Linux or py check_cve_2026_11166.py on Windows; no admin rights are required as long as the user can execute the local Chrome binary.

#!/usr/bin/env python3
# CVE-2026-11166 Chrome version check
# Outputs: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import shutil
import subprocess
import sys

TARGET = (149, 0, 7827, 53)


def norm_version_tuple(text):
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def cmp_ver(a, b):
    return (a > b) - (a < b)


def run_version(cmd):
    try:
        p = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True, timeout=10)
        out = (p.stdout or '').strip()
        return out
    except Exception:
        return ''


def windows_candidates():
    cands = []
    for env in ('ProgramFiles', 'ProgramFiles(x86)', 'LocalAppData'):
        base = os.environ.get(env)
        if base:
            cands.append(os.path.join(base, 'Google', 'Chrome', 'Application', 'chrome.exe'))
    which = shutil.which('chrome.exe') or shutil.which('chrome')
    if which:
        cands.append(which)
    return cands


def mac_candidates():
    cands = [
        '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
        os.path.expanduser('~/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'),
    ]
    which = shutil.which('google-chrome') or shutil.which('chrome')
    if which:
        cands.append(which)
    return cands


def linux_candidates():
    names = ['google-chrome', 'google-chrome-stable', 'chrome', 'chromium', 'chromium-browser']
    cands = [shutil.which(n) for n in names]
    cands += ['/usr/bin/google-chrome', '/opt/google/chrome/chrome']
    return [c for c in cands if c]


def get_candidates():
    system = platform.system().lower()
    if system == 'windows':
        return windows_candidates()
    if system == 'darwin':
        return mac_candidates()
    return linux_candidates()


def first_existing(paths):
    seen = set()
    out = []
    for p in paths:
        if p and p not in seen:
            seen.add(p)
            out.append(p)
    return out


def main():
    candidates = first_existing(get_candidates())
    if not candidates:
        print('UNKNOWN: Google Chrome executable not found')
        sys.exit(2)

    for exe in candidates:
        if not os.path.exists(exe):
            continue
        out = run_version([exe, '--version'])
        ver = norm_version_tuple(out)
        if ver is None:
            continue

        # CVE fixed in 149.0.7827.53 or later per vendor advisory
        if cmp_ver(ver, TARGET) < 0:
            print(f'VULNERABLE: {exe} -> {ver[0]}.{ver[1]}.{ver[2]}.{ver[3]}')
            sys.exit(1)
        else:
            print(f'PATCHED: {exe} -> {ver[0]}.{ver[1]}.{ver[2]}.{ver[3]}')
            sys.exit(0)

    print('UNKNOWN: Chrome found but version could not be determined')
    sys.exit(2)


if __name__ == '__main__':
    main()

Sources

1. Google Chrome Releases: Stable Channel Update for Desktop (2026-06-02)
2. Google Chrome Releases: Early Stable Update for Desktop (2026-05-29)
3. CISA Known Exploited Vulnerabilities Catalog
4. FIRST EPSS
5. Canadian Centre for Cyber Security advisory AV26-544
6. Guyana National CIRT advisory ADV2026_360
7. SecurityWeek: Chrome 149 Patches 429 Vulnerabilities
8. NVD comparator: CVE-2026-11169 in same Chrome 149 release train