Inappropriate implementation in SVG in Google Chrome prior to 149

CVE-2026-11182 is an information-disclosure flaw in Chrome's SVG handling that can let a malicious webpage read data that should stay isolated by the browser's same-origin boundary. Based on the vendor intel and reviewed release material, affected builds are Chrome versions before 149.0.7827.53 on Linux and before 149.0.7827.53/.54 on Windows and macOS; *inference:* the reviewed sources do not show an Extended Stable backport yet, so managed 148.x fleets should be treated as potentially exposed until Google explicitly says otherwise.

Google's MEDIUM 6.5 label is about right in the real world. The exposure population is enormous because Chrome is everywhere and the attacker only needs a victim to render a crafted page, but the payload is still *confidentiality-only*, there is no known KEV entry or public exploitation evidence, and the likely blast radius is a user's browser session rather than host takeover.

Why this verdict

• Wide reach, limited outcome: attacker position is unauthenticated remote and the reachable population is huge because Chrome is everywhere, so the vendor baseline is not crazy.
• User interaction is real downward pressure: the chain still requires the victim to render attacker content, which means email security, DNS/SWG, and browser isolation can stop the first step in many enterprises.
• Confidentiality-only impact keeps it out of HIGH: this is a same-origin boundary failure, not host compromise, not sandbox escape, and not a persistence foothold.
• No exploitation pressure: no KEV listing, no public zero-day statement, no public PoC found, and EPSS is extremely low, so there is no evidence-based reason to upgrade severity.
• Population narrowing at step 3 matters: the attacker only wins valuable data when the victim also has useful cross-origin session state in that browser, which cuts down practical payoff versus the raw CVSS story.

Why not higher?

If this had active exploitation, a clean public PoC, or it chained directly to code execution or sandbox escape, the score would jump. But on the evidence available, this is still a browser data-leak issue that needs a victim session and a lure, not a fast-moving enterprise-breach primitive.

Why not lower?

I am not pushing this down to LOW because browser bugs ride on the most exposed attack surface you own: users opening web content all day. Even without code execution, a same-origin bypass can still steal tokens or sensitive app data from high-value users, so it deserves routine patch-cycle attention rather than backlog neglect.

1. Force auto-update compliance — Verify Chrome is actually honoring your managed update channel and target version policy. For a MEDIUM verdict there is no mitigation SLA — go straight to the 365-day remediation window, but in practice browser fleets should not drift; use this now to collapse exposure before stragglers accumulate.
2. Harden web egress and click controls — Keep phishing protection, DNS filtering, SWG reputation blocking, and safe browsing controls tight because they interrupt the only mandatory first step: getting a user to render the hostile page. There is no mitigation SLA for MEDIUM here, so treat this as standing control hygiene while you roll the patch.
3. Use browser isolation for risky user groups — Remote/browser isolation is one of the few controls that directly shrinks exploitability for client-side rendering bugs by moving page execution away from the endpoint. Prioritize execs, finance, admins, and internet-heavy users while you complete remediation in the normal window.
4. Reduce session-value in the browser — Shorter session lifetimes, stronger token scoping, SameSite cookies, and re-authentication for sensitive actions reduce what a cross-origin leak can actually buy an attacker. This does not replace patching, but it caps blast radius for this class of browser confidentiality flaw.

Run this on the target endpoint or through your software inventory agent. Invoke it with python3 chrome_cve_2026_11182_check.py on macOS/Linux or py chrome_cve_2026_11182_check.py on Windows; no admin rights are usually required, but Windows registry reads and some install paths may work more reliably in an elevated shell.

#!/usr/bin/env python3
# CVE-2026-11182 Chrome version check
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import subprocess
import sys
from shutil import which

THRESHOLD = (149, 0, 7827, 53)
WIN_MAC_THRESHOLD = (149, 0, 7827, 53)  # .54 is also patched; .53 and above are acceptable


def parse_version(text):
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def ver_to_str(v):
    return '.'.join(str(x) for x in v)


def run_cmd(cmd):
    try:
        p = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, timeout=10)
        out = (p.stdout or '') + '\n' + (p.stderr or '')
        return out.strip()
    except Exception:
        return ''


def get_versions_windows():
    found = []
    candidates = [
        os.path.expandvars(r'%ProgramFiles%\Google\Chrome\Application\chrome.exe'),
        os.path.expandvars(r'%ProgramFiles(x86)%\Google\Chrome\Application\chrome.exe'),
        os.path.expandvars(r'%LocalAppData%\Google\Chrome\Application\chrome.exe'),
    ]

    for exe in candidates:
        if os.path.exists(exe):
            out = run_cmd([exe, '--version'])
            v = parse_version(out)
            if v:
                found.append((exe, v))

    reg_paths = [
        r'HKLM\Software\Google\Chrome\BLBeacon',
        r'HKLM\Software\WOW6432Node\Google\Chrome\BLBeacon',
        r'HKCU\Software\Google\Chrome\BLBeacon',
    ]
    for key in reg_paths:
        out = run_cmd(['reg', 'query', key, '/v', 'version'])
        v = parse_version(out)
        if v:
            found.append((key, v))

    return dedupe(found)


def get_versions_macos():
    found = []
    candidates = [
        '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
        os.path.expanduser('~/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'),
    ]
    for exe in candidates:
        if os.path.exists(exe):
            out = run_cmd([exe, '--version'])
            v = parse_version(out)
            if v:
                found.append((exe, v))
    return dedupe(found)


def get_versions_linux():
    found = []
    commands = ['google-chrome', 'google-chrome-stable', 'chrome', 'chromium', 'chromium-browser']
    for cmd in commands:
        path = which(cmd)
        if path:
            out = run_cmd([path, '--version'])
            v = parse_version(out)
            if v:
                found.append((path, v))
    return dedupe(found)


def dedupe(items):
    seen = set()
    out = []
    for src, ver in items:
        key = (src, ver)
        if key not in seen:
            seen.add(key)
            out.append((src, ver))
    return out


def is_patched(ver):
    return ver >= THRESHOLD


def main():
    system = platform.system().lower()
    if 'windows' in system:
        found = get_versions_windows()
    elif 'darwin' in system:
        found = get_versions_macos()
    else:
        found = get_versions_linux()

    if not found:
        print('UNKNOWN: Google Chrome version not found')
        sys.exit(2)

    vulnerable = []
    patched = []
    unknown = []

    for src, ver in found:
        if is_patched(ver):
            patched.append((src, ver))
        else:
            vulnerable.append((src, ver))

    if vulnerable:
        print('VULNERABLE')
        for src, ver in vulnerable:
            print(f'  source={src} version={ver_to_str(ver)} threshold={ver_to_str(THRESHOLD)}')
        if patched:
            for src, ver in patched:
                print(f'  patched_install={src} version={ver_to_str(ver)}')
        sys.exit(1)

    if patched:
        print('PATCHED')
        for src, ver in patched:
            print(f'  source={src} version={ver_to_str(ver)} threshold={ver_to_str(THRESHOLD)}')
        sys.exit(0)

    print('UNKNOWN: unable to determine vulnerability state')
    sys.exit(2)


if __name__ == '__main__':
    main()

Sources

1. Google Chrome Releases - Early Stable Update for Desktop (149.0.7827.53/.54)
2. Chrome for Testing availability - stable 149.0.7827.53
3. Chrome Enterprise - browser release channels
4. Chrome Enterprise - manage Chrome updates
5. CISA Known Exploited Vulnerabilities Catalog
6. FIRST EPSS data and statistics
7. FIRST EPSS API documentation
8. Google Chrome stable release note showing restricted bug-detail practice