Integer overflow in Blink in Google Chrome prior to 149

CVE-2026-11171 is an integer overflow in Blink, Chrome's rendering engine, affecting Google Chrome before 149.0.7827.53 on Linux and 149.0.7827.53/.54 on Windows and macOS. A malicious site can feed crafted HTML to the renderer and achieve code execution *inside the renderer sandbox*, which means attacker code lands in a tightly constrained browser process rather than on the host OS outright.

The vendor-to-reality gap is meaningful here. NVD shows a CISA-ADP 8.8/HIGH CVSS vector, but Google's own release notes classify the bug as Medium, and the decisive reason is practical blast radius: this bug still needs user interaction and stops at sandboxed renderer execution unless the attacker brings a second bug, a sandbox escape, or a high-value browser-data objective.

Why this verdict

• Downward pressure: renderer sandbox means the bug stops at sandboxed code exec, so the CVSS host-impact assumptions are too generous for the standalone CVE
• Downward pressure: user interaction required; this is not unauthenticated remote-to-service exploitation, it needs a victim to render attacker content
• Downward pressure: no active exploitation signal; not KEV-listed and the supplied EPSS is extremely low
• Upward pressure: huge fleet footprint; Chrome is ubiquitous, so even a sandboxed bug can matter at enterprise scale
• Upward pressure: low attack complexity in theory once a victim visits the malicious page, so targeted phishing and drive-by delivery remain plausible

Why not higher?

It is not higher because this is not a one-CVE workstation takeover in the facts we have. The attack path requires user interaction, lands in a sandboxed renderer, and needs either valuable browser-resident data or a second bug to become full host compromise; that is too much compounded friction for HIGH in a 10,000-host enterprise queue.

Why not lower?

It is not lower because renderer compromise is still real code execution against one of the most widely deployed userland targets in the estate. Even sandboxed bugs can be operationally important for high-risk users, targeted phishing populations, and future exploit chains if a sandbox escape appears later.

1. Enforce Chrome auto-update and version compliance — Use enterprise browser management to block lagging channels and verify all managed endpoints move to 149.0.7827.53/.54 or later. With a MEDIUM verdict there is no mitigation SLA — go straight to the 365-day remediation window, but browsers should still be kept on normal rapid-update policy because version drift is the easiest way these bugs stay exploitable.
2. Apply browser isolation for high-risk users — Route internet browsing for admins, finance, executives, and exposed users through remote browser isolation or equivalent containment where available. For this MEDIUM verdict there is no mitigation SLA, so use this as risk reduction for sensitive populations while staying within the ≤365 day remediation horizon.
3. Separate admin activity from daily browsing — Keep privileged accounts off general web browsing sessions so that a renderer compromise cannot immediately touch high-value admin cookies or workflows. There is no mitigation SLA for MEDIUM, but this control is worth standardizing because it shrinks the payoff of the bug even if exploitation happens.
4. Keep Site Isolation and exploit protections enabled — Do not relax Chrome hardening flags or enterprise policies that weaken process isolation, sandboxing, or Safe Browsing. There is no mitigation SLA here, but preserving those defaults is one of the main reasons this CVE reassesses downward in the first place.

Run this on the target endpoint or from your software-audit tooling on each host. Invoke it with python3 check_chrome_cve_2026_11171.py on macOS/Linux or py check_chrome_cve_2026_11171.py on Windows; no admin rights are required unless your EDR blocks process version queries.

#!/usr/bin/env python3
# check_chrome_cve_2026_11171.py
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import subprocess
import sys
from shutil import which

PATCHED = (149, 0, 7827, 53)

WINDOWS_CANDIDATES = [
    r"C:\Program Files\Google\Chrome\Application\chrome.exe",
    r"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe",
    os.path.expandvars(r"%LOCALAPPDATA%\Google\Chrome\Application\chrome.exe"),
]

MAC_CANDIDATES = [
    "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome",
    os.path.expanduser("~/Applications/Google Chrome.app/Contents/MacOS/Google Chrome"),
]

LINUX_CANDIDATES = [
    which("google-chrome"),
    which("google-chrome-stable"),
    which("chromium-browser"),
    which("chromium"),
    "/opt/google/chrome/chrome",
    "/usr/bin/google-chrome",
    "/usr/bin/google-chrome-stable",
]


def parse_version(text):
    m = re.search(r"(\d+)\.(\d+)\.(\d+)\.(\d+)", text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def version_string(v):
    return ".".join(str(x) for x in v)


def compare_versions(a, b):
    return (a > b) - (a < b)


def get_candidates():
    system = platform.system().lower()
    if system == "windows":
        return [p for p in WINDOWS_CANDIDATES if p]
    if system == "darwin":
        return [p for p in MAC_CANDIDATES if p]
    return [p for p in LINUX_CANDIDATES if p]


def get_version_from_binary(path):
    try:
        out = subprocess.check_output([path, "--version"], stderr=subprocess.STDOUT, text=True, timeout=10)
        return parse_version(out)
    except Exception:
        return None


def main():
    candidates = get_candidates()
    existing = [p for p in candidates if p and os.path.exists(p)]

    if not existing:
        print("UNKNOWN: Chrome binary not found in standard locations")
        sys.exit(2)

    for path in existing:
        version = get_version_from_binary(path)
        if version is None:
            continue

        status = "PATCHED" if compare_versions(version, PATCHED) >= 0 else "VULNERABLE"
        print(f"{status}: {path} version {version_string(version)} (fixed: {version_string(PATCHED)})")
        sys.exit(0 if status == "PATCHED" else 1)

    print("UNKNOWN: Chrome found but version could not be determined")
    sys.exit(2)


if __name__ == "__main__":
    main()

Sources

1. NVD entry for CVE-2026-11171
2. Chrome Stable Channel Update for Desktop
3. Chromium issue 502322843
4. CISA Known Exploited Vulnerabilities Catalog
5. FIRST EPSS overview
6. Chromium Security page
7. Chromium Site Isolation overview
8. Chrome sandbox diagnostics for Windows