Insufficient policy enforcement in Actor in Google Chrome prior to 149

CVE-2026-11184 is an *insufficient policy enforcement* bug in Chrome's Actor component that affects Chrome versions prior to 149.0.7827.53 on Linux and 149.0.7827.53/54 on Windows and macOS. The published impact is *bypass navigation restrictions* via a crafted HTML page, which means a malicious site can make the browser perform a navigation the platform policy should have blocked.

Google rated it MEDIUM at 6.3, and that is defensible in a vacuum, but it still overstates the operational urgency for enterprise patch triage. This is client-side, requires user interaction, has no published RCE/data-theft primitive in the advisory, no KEV listing, no public exploit chain, and the practical outcome is policy bypass rather than code execution or sandbox escape.

Why this verdict

• User interaction is mandatory: the attacker must get a victim onto crafted HTML, which means this starts after a successful lure or ad-delivery event.
• The bug class is narrow: the advisory describes *bypass navigation restrictions*, not code execution, sandbox escape, or origin-crossing data theft.
• No exploitation signal: no KEV listing, no public campaign reporting, and no public PoC reduces the urgency multiplier that would otherwise keep this in MEDIUM.
• Browser-only blast radius: impact stays in the user's browsing context unless chained with social engineering or another vulnerability.
• Exposure is broad but shallow: Chrome is everywhere, but widespread installation is not the same as high-severity exploitability when every attack still depends on user interaction and a narrow browser behavior flaw.

Why not higher?

There is no published evidence that this flaw alone yields code execution, sandbox escape, account takeover, or silent data extraction. The entire chain depends on the victim opening crafted content and the attacker successfully converting a navigation-policy bypass into something materially damaging.

Why not lower?

It still affects a massively deployed client application and can plausibly assist phishing, redirect abuse, or web-security boundary confusion at scale. If your environment has many unmanaged browsers or weak browser-update hygiene, the exposure population can still be large enough that this should not be ignored entirely.

1. Enforce browser auto-update — Make sure Chrome stable auto-update is functioning across managed Windows, macOS, and Linux endpoints. For a LOW verdict, treat this as backlog hygiene and complete it in your normal browser maintenance cycle rather than opening an incident lane.
2. Block high-risk web delivery paths — Use SWG/DNS filtering, category controls, and Safe Browsing policy enforcement to reduce first-stage delivery of malicious landing pages. This is the best temporary control because the attack begins with a user opening crafted content.
3. Harden identity flows — Require phishing-resistant MFA where possible and keep IdP risk policies tuned for suspicious redirects and anomalous sign-ins. That limits the value of any navigation-confusion or redirect abuse the attacker tries to derive from the browser flaw.
4. Inventory out-of-date Chrome builds — Use EDR, MDM, SCCM, Intune, Jamf, or package inventory to find hosts still below 149.0.7827.53. For a LOW verdict, there is no fixed mitigation SLA; keep this in routine hygiene and drive closure through your standard patch governance.

Run this on the target endpoint or through your software-distribution/EDR script runner. Invoke it as python3 chrome_cve_2026_11184_check.py on macOS/Linux or py chrome_cve_2026_11184_check.py on Windows; no admin rights are required for standard install paths, but wider file-system access improves discovery coverage.

#!/usr/bin/env python3
# CVE-2026-11184 Chrome version check
# Outputs: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import re
import sys
import subprocess
import platform
from pathlib import Path

TARGET = (149, 0, 7827, 53)


def parse_version(s):
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', s or '')
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def cmp_ver(a, b):
    return (a > b) - (a < b)


def run_cmd(cmd):
    try:
        p = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, timeout=10)
        out = (p.stdout or '') + '\n' + (p.stderr or '')
        return out.strip()
    except Exception:
        return ''


def candidate_paths():
    paths = []
    system = platform.system().lower()

    if system == 'windows':
        envs = [os.environ.get('ProgramFiles'), os.environ.get('ProgramFiles(x86)'), os.environ.get('LocalAppData')]
        rels = [
            r'Google\Chrome\Application\chrome.exe',
            r'Chromium\Application\chrome.exe'
        ]
        for base in envs:
            if base:
                for rel in rels:
                    paths.append(Path(base) / rel)
    elif system == 'darwin':
        paths.extend([
            Path('/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'),
            Path.home() / 'Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
            Path('/Applications/Chromium.app/Contents/MacOS/Chromium')
        ])
    else:
        paths.extend([
            Path('/usr/bin/google-chrome'),
            Path('/usr/bin/google-chrome-stable'),
            Path('/usr/bin/chromium'),
            Path('/usr/bin/chromium-browser'),
            Path('/opt/google/chrome/chrome')
        ])
    return paths


def get_version_from_binary(path):
    if not path.exists():
        return None
    out = run_cmd([str(path), '--version'])
    return parse_version(out)


def get_windows_registry_version():
    keys = [
        r'HKLM\Software\Google\Chrome\BLBeacon',
        r'HKLM\Software\WOW6432Node\Google\Chrome\BLBeacon',
        r'HKCU\Software\Google\Chrome\BLBeacon'
    ]
    for key in keys:
        out = run_cmd(['reg', 'query', key, '/v', 'version'])
        ver = parse_version(out)
        if ver:
            return ver
    return None


def discover_version():
    system = platform.system().lower()

    if system == 'windows':
        ver = get_windows_registry_version()
        if ver:
            return ver, 'registry'

    for path in candidate_paths():
        ver = get_version_from_binary(path)
        if ver:
            return ver, str(path)

    common_cmds = ['google-chrome', 'google-chrome-stable', 'chromium', 'chromium-browser', 'chrome']
    for cmd in common_cmds:
        out = run_cmd([cmd, '--version'])
        ver = parse_version(out)
        if ver:
            return ver, cmd

    return None, None


def main():
    ver, source = discover_version()
    if not ver:
        print('UNKNOWN - Chrome/Chromium version not found')
        sys.exit(2)

    ver_str = '.'.join(str(x) for x in ver)
    if cmp_ver(ver, TARGET) < 0:
        print(f'VULNERABLE - detected version {ver_str} from {source}; needs >= 149.0.7827.53')
        sys.exit(1)
    else:
        print(f'PATCHED - detected version {ver_str} from {source}; meets >= 149.0.7827.53')
        sys.exit(0)


if __name__ == '__main__':
    main()

Sources

1. Google Chrome Releases - Stable Channel Update for Desktop
2. Chromium issue 502777516
3. Chromium Security page
4. CISA Known Exploited Vulnerabilities Catalog
5. FIRST EPSS overview
6. FIRST EPSS API documentation
7. Canadian Centre for Cyber Security advisory AV26-544
8. SecurityWeek coverage of Chrome 149 patch set