Inappropriate implementation in XML in Google Chrome prior to 149

CVE-2026-11169 is a UXSS/XML injection issue in Google Chrome before 149.0.7827.53 that lets a remote attacker get arbitrary script or HTML to run in the browser via a crafted XML file. In practice, the attacker still needs delivery: phishing, a malicious site, or some other way to get a user to open or render the attacker-controlled XML content in vulnerable Chrome builds on Windows, macOS, or Linux.

The raw 8.1/HIGH score overstates enterprise urgency. Yes, a browser-origin confusion bug can expose session data and let an attacker act as the user inside the browser, but the chain still depends on user interaction, browser reachability, and per-user session scope; there is no evidence of in-the-wild exploitation, no KEV listing, and the advisory itself describes the Chromium bug-class severity as Medium.

Why this verdict

• Downgrade for attacker position: this is remote content to browser exploitation, not unauthenticated remote code execution against a server or appliance.
• Downgrade for prerequisite chain: UI:R means the attacker needs a user to open or render the crafted XML content; that is real friction in enterprise deployments.
• Downgrade for exposure model: Chrome is widely deployed, but the vulnerability is not internet-scannable infrastructure; reachable population is limited to users who can be lured.
• Downgrade for blast radius: the primary impact is browser-session compromise for one user at a time, not direct host takeover or default lateral movement.
• Downgrade for threat intel: there is no KEV listing, no public in-the-wild exploitation evidence, and the supplied EPSS is extremely low.

Why not higher?

If this were being actively exploited, KEV-listed, or paired with a sandbox escape or reliable auth-token theft against high-value SaaS workflows, the score would rise fast. But on the facts available, this is a single-bug browser trust issue that still depends on user interaction and does not by itself deliver OS-level compromise.

Why not lower?

This is still more than backlog lint. A successful UXSS bug in a mainstream browser can let an attacker act inside a victim's authenticated web context, which is enough for mailbox abuse, SaaS actions, and data theft. For enterprises with heavy browser-based workflows and SSO, that is meaningful operational risk.

1. Enforce browser auto-update — Make sure Chrome stable updates are centrally enforced through enterprise policy so vulnerable builds age out naturally. For a MEDIUM verdict there is no mitigation SLA — go straight to the 365-day remediation window, but browser controls should still keep drift low on day-to-day operations.
2. Block direct XML launch paths from untrusted sources — Use mail gateway, web proxy, and endpoint controls to reduce delivery of untrusted XML attachments and downloads where business use is rare. This does not replace patching, but it raises the cost of phishing-style exploitation during the remediation window.
3. Harden SaaS sessions — Apply re-authentication, conditional access, and transaction protections for sensitive web apps so a browser-session bug is less valuable. This matters because the most realistic post-exploit outcome here is acting as the logged-in user.
4. Monitor for browser-driven identity abuse — Tune detections around mailbox rule creation, impossible travel, unusual OAuth grants, and abnormal SaaS actions originating from user sessions. That is where this CVE is most likely to show up operationally if exploited.

Run this on the target endpoint or through your EDR live-response shell with standard user rights; admin is not required. Save as check_cve_2026_11169.py and run python3 check_cve_2026_11169.py on macOS/Linux or py -3 check_cve_2026_11169.py on Windows. It looks for Google Chrome, extracts the installed version, and prints VULNERABLE, PATCHED, or UNKNOWN.

#!/usr/bin/env python3
# check_cve_2026_11169.py
# Detects whether installed Google Chrome is vulnerable to CVE-2026-11169
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN / Chrome not found / parse failure

import os
import platform
import re
import subprocess
import sys
from pathlib import Path

FIXED_VERSION = (149, 0, 7827, 53)


def parse_version(text):
    if not text:
        return None
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def run_cmd(cmd):
    try:
        p = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, timeout=10)
        out = (p.stdout or '') + '\n' + (p.stderr or '')
        return out.strip()
    except Exception:
        return ''


def get_version_windows():
    candidates = [
        Path(os.environ.get('PROGRAMFILES', r'C:\Program Files')) / 'Google/Chrome/Application/chrome.exe',
        Path(os.environ.get('PROGRAMFILES(X86)', r'C:\Program Files (x86)')) / 'Google/Chrome/Application/chrome.exe',
        Path(os.environ.get('LOCALAPPDATA', '')) / 'Google/Chrome/Application/chrome.exe',
    ]
    for exe in candidates:
        if exe and exe.exists():
            out = run_cmd(['powershell', '-NoProfile', '-Command', f"(Get-Item '{str(exe)}').VersionInfo.ProductVersion"])
            ver = parse_version(out)
            if ver:
                return str(exe), ver
    return None, None


def get_version_macos():
    candidates = [
        '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
        str(Path.home() / 'Applications/Google Chrome.app/Contents/MacOS/Google Chrome')
    ]
    for exe in candidates:
        if Path(exe).exists():
            out = run_cmd([exe, '--version'])
            ver = parse_version(out)
            if ver:
                return exe, ver
    return None, None


def get_version_linux():
    commands = [
        ['google-chrome', '--version'],
        ['google-chrome-stable', '--version'],
        ['chromium-browser', '--version'],
        ['chromium', '--version'],
    ]
    for cmd in commands:
        out = run_cmd(cmd)
        ver = parse_version(out)
        if ver and ('chrome' in out.lower() or 'chromium' in out.lower()):
            return ' '.join(cmd[:-1]), ver

    candidates = [
        '/opt/google/chrome/google-chrome',
        '/usr/bin/google-chrome',
        '/usr/bin/google-chrome-stable',
    ]
    for exe in candidates:
        if Path(exe).exists():
            out = run_cmd([exe, '--version'])
            ver = parse_version(out)
            if ver:
                return exe, ver
    return None, None


def compare_versions(installed, fixed):
    if installed < fixed:
        return 'VULNERABLE'
    return 'PATCHED'


def main():
    system = platform.system().lower()
    path = None
    version = None

    if 'windows' in system:
        path, version = get_version_windows()
    elif 'darwin' in system:
        path, version = get_version_macos()
    elif 'linux' in system:
        path, version = get_version_linux()
    else:
        print('UNKNOWN: unsupported platform')
        sys.exit(2)

    if not version:
        print('UNKNOWN: Google Chrome not found or version unreadable')
        sys.exit(2)

    result = compare_versions(version, FIXED_VERSION)
    version_str = '.'.join(str(x) for x in version)
    fixed_str = '.'.join(str(x) for x in FIXED_VERSION)
    print(f'{result}: installed={version_str} fixed={fixed_str} path={path}')

    if result == 'PATCHED':
        sys.exit(0)
    elif result == 'VULNERABLE':
        sys.exit(1)
    else:
        sys.exit(2)


if __name__ == '__main__':
    main()

Sources

1. NVD CVE-2026-11169
2. Chrome Releases: Stable Channel Update for Desktop (June 2, 2026)
3. Chromium issue reference 502285273
4. Chromium Security
5. Chromium Site Isolation overview
6. CISA Known Exploited Vulnerabilities Catalog
7. FIRST EPSS overview
8. FIRST EPSS API documentation