Inappropriate implementation in Site Isolation in Google Chrome prior to 149

CVE-2026-11174 is an insufficient policy enforcement flaw in Chrome's Site Isolation protections. Affected builds are Google Chrome before 149.0.7827.53 on Linux and before 149.0.7827.53/54 on Windows and macOS. In plain English: if an attacker already has control of the renderer process and can get the user onto a crafted page, this bug may let that compromised renderer reach across origin boundaries and expose data that Site Isolation is supposed to keep separated.

Google labeled it MEDIUM (5.3), but in enterprise triage this lands lower. The decisive friction is the prerequisite: the attacker must already have compromised the renderer process. That means this bug is not initial access, not straight drive-by compromise, and not something an external scanner can hit on your perimeter. It is useful in an exploit chain, but weak as a standalone reason to burn emergency patching capacity.

Why this verdict

• Renderer compromise required: this is the biggest severity haircut; needing a prior browser exploit compounds real-world friction immediately.
• User-driven reachability only: the attacker still needs the target to browse attacker-controlled content, so this is not a server-side, always-on exposure.
• Blast radius is browser-session scoped: impact is cross-origin data exposure inside Chrome, not direct OS takeover or domain-wide compromise.

Why not higher?

Because the prerequisite chain is brutal. Requiring *unauthenticated remote + user interaction + separate renderer compromise* means most real deployments only become vulnerable after another successful exploit already landed. That's a classic chain amplifier, not a top-of-queue patch driver by itself.

Why not lower?

It is still a security-boundary failure in one of the most widely deployed enterprise applications on earth. If paired with an actively exploited renderer bug, the value of this flaw rises fast because it can turn a sandboxed browser foothold into meaningful cross-origin data theft.

1. Enforce browser auto-update — Make sure enterprise policy keeps Chrome updating normally across managed endpoints and VDI images. For a LOW verdict there is no SLA (treat as backlog hygiene), so the right move is to let standard browser rings pull 149.0.7827.53+ rather than trigger emergency change windows.
2. Watch for companion Chrome exploits — Track whether a renderer RCE, UXSS, or actively exploited Chrome zero-day emerges against the same release family. This CVE becomes materially more important only when paired with that first-stage exploit; for LOW, handle this in normal threat-monitoring cadence with no SLA (treat as backlog hygiene).
3. Reduce risky web content paths — Keep Safe Browsing, web filtering, attachment detonation, and ad/tracker controls enforced to cut down the chance of users reaching exploit delivery pages. These are reasonable hardening measures, but for this LOW issue there is no SLA (treat as backlog hygiene) rather than an urgent mitigation deadline.
4. Harden browser telemetry collection — Retain browser crash logs, EDR browser exploit alerts, and suspicious egress telemetry so you can spot the *other* bug this one depends on. Again, this is hygiene work: no SLA (treat as backlog hygiene).

Run this on the target endpoint or through your software inventory tooling. Invoke it with python3 check_chrome_cve_2026_11174.py on macOS/Linux or py check_chrome_cve_2026_11174.py on Windows; no admin rights are required if the Chrome binary is in a standard install path.

#!/usr/bin/env python3
# check_chrome_cve_2026_11174.py
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN

import os
import platform
import re
import subprocess
import sys
from shutil import which

TARGET = "149.0.7827.53"


def parse_version(text):
    m = re.search(r"(\d+)\.(\d+)\.(\d+)\.(\d+)", text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def cmp_ver(a, b):
    return (a > b) - (a < b)


def run_version(cmd):
    try:
        p = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True, timeout=5)
        out = (p.stdout or "").strip()
        v = parse_version(out)
        return out, v
    except Exception:
        return "", None


def candidates():
    system = platform.system().lower()
    cmds = []

    if system == "windows":
        local = os.environ.get("LOCALAPPDATA", "")
        pf = os.environ.get("PROGRAMFILES", "C:\\Program Files")
        pfx86 = os.environ.get("PROGRAMFILES(X86)", "C:\\Program Files (x86)")
        paths = [
            os.path.join(local, "Google", "Chrome", "Application", "chrome.exe"),
            os.path.join(pf, "Google", "Chrome", "Application", "chrome.exe"),
            os.path.join(pfx86, "Google", "Chrome", "Application", "chrome.exe"),
        ]
        for p in paths:
            cmds.append([p, "--version"])
        if which("chrome"):
            cmds.append([which("chrome"), "--version"])
    elif system == "darwin":
        paths = [
            "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome",
            os.path.expanduser("~/Applications/Google Chrome.app/Contents/MacOS/Google Chrome"),
        ]
        for p in paths:
            cmds.append([p, "--version"])
        for name in ["google-chrome", "chrome", "chromium", "chromium-browser"]:
            if which(name):
                cmds.append([which(name), "--version"])
    else:
        for name in ["google-chrome", "google-chrome-stable", "chrome", "chromium", "chromium-browser"]:
            if which(name):
                cmds.append([which(name), "--version"])
        for p in [
            "/opt/google/chrome/chrome",
            "/usr/bin/google-chrome",
            "/usr/bin/google-chrome-stable",
            "/snap/bin/chromium",
        ]:
            cmds.append([p, "--version"])

    # Deduplicate while preserving order
    seen = set()
    uniq = []
    for cmd in cmds:
        key = tuple(cmd)
        if key not in seen:
            seen.add(key)
            uniq.append(cmd)
    return uniq


def main():
    target_v = parse_version(TARGET)
    found = []

    for cmd in candidates():
        exe = cmd[0]
        if not os.path.exists(exe) and which(exe) is None:
            continue
        raw, ver = run_version(cmd)
        if ver:
            found.append((exe, raw, ver))

    if not found:
        print("UNKNOWN - Google Chrome not found in standard paths or version could not be determined")
        sys.exit(2)

    # Prefer Google Chrome over Chromium where possible
    found.sort(key=lambda x: ("google" not in x[0].lower(), x[0]))
    exe, raw, ver = found[0]

    if cmp_ver(ver, target_v) < 0:
        print(f"VULNERABLE - {raw} at {exe} is older than {TARGET}")
        sys.exit(1)
    else:
        print(f"PATCHED - {raw} at {exe} is {TARGET} or newer")
        sys.exit(0)


if __name__ == "__main__":
    main()

Sources

1. Chrome Stable Channel Update for Desktop (Chrome 149)
2. Chrome Early Stable Update for Desktop
3. Chromium Site Isolation overview
4. Chromium Security page
5. CISA Known Exploited Vulnerabilities Catalog
6. FIRST EPSS API documentation