Inappropriate implementation in CSS in Google Chrome prior to 149

CVE-2026-11186 is a Chrome CSS implementation flaw that can let a remote attacker inject arbitrary script or HTML via a crafted page. Affected builds are Chrome versions prior to 149.0.7827.53 on Linux and prior to 149.0.7827.53/54 on Windows and macOS; Android inherits the corresponding desktop security fixes in 149.0.7827.59 unless otherwise noted by Google.

Google scored it MEDIUM (6.1), and that is basically right. The amplifier is obvious: Chrome is everywhere, so a browser bug can touch a very large population fast. But the downward pressure matters more here: exploitation requires user interaction, impact is browser-session level rather than OS-level, there is no current KEV listing or public in-the-wild evidence, and the technical details are still partly restricted while the fix rolls out.

Why this verdict

• Baseline holds: Google already placed this at MEDIUM 6.1, and the published vector says remote/no-privs but *user-interaction required* with only low confidentiality/integrity impact.
• User must browse attacker content: that implies phishing, malvertising, or a compromised site. Modern email gateways, SWGs, DNS filtering, and Safe Browsing add real-world drag before exploit code ever runs.
• Browser bug, not box-owning bug: this is script/HTML injection in Chrome CSS, not a memory-corruption path to native code execution. The blast radius is usually the user's active browser session and web apps, not the endpoint OS.
• No exploit pressure signals: no KEV entry, no public exploitation note from Google, and an EPSS of 0.00026 all push this down versus Chrome bugs that are already being used in the wild.
• Reachable population is broad but not uniformly exploitable: Chrome is ubiquitous, but only vulnerable unmanaged or not-yet-updated clients matter, and Chrome's auto-update materially shrinks the exposure window in managed fleets.

Why not higher?

This does not earn HIGH because the chain is not straight-through unauthenticated compromise of a service or endpoint. The attacker needs a user to render malicious content, and the published impact is low confidentiality/low integrity with no availability hit, which is a long way from reliable enterprise-wide compromise.

Why not lower?

This is not LOW because Chrome is one of the widest exposure surfaces in the enterprise, and a browser-origin break can still steal SaaS sessions or tamper with business workflows. Even without RCE, one-click client-side abuse against a heavily used browser deserves real patching attention.

1. Enforce Chrome auto-update — Verify policy-backed auto-update on all managed endpoints and browsers, especially VDI and kiosk pools. For a MEDIUM verdict there is no mitigation SLA — go straight to the 365-day remediation window, but auto-update validation should happen in the normal browser operations cycle because it closes this and the other 428 fixes in the same release.
2. Filter risky web delivery paths — Tighten Secure Web Gateway, DNS, and phishing controls around newly registered domains, ad-tech categories, and user-clicked external links. There is no mitigation SLA — go straight to the 365-day remediation window, but this is the best temporary drag on the required user-interaction step.
3. Harden session abuse defenses — Use conditional access, step-up auth for sensitive actions, and shorter session/token lifetimes where business allows. There is no mitigation SLA — go straight to the 365-day remediation window, and these controls specifically reduce the value of any browser-session theft this class of bug could enable.
4. Inventory stragglers aggressively — Query software inventory, EDR, or Chrome enterprise telemetry for versions below 149.0.7827.53 and isolate unmanaged exceptions such as lab hosts, offline laptops, gold images, and nonpersistent VDI templates. There is no mitigation SLA — go straight to the 365-day remediation window, so use regular hygiene processes rather than emergency change windows.

Run this on the target endpoint or through your fleet management tool. Invoke it as python3 chrome_cve_2026_11186_check.py on macOS/Linux or py chrome_cve_2026_11186_check.py on Windows; no admin rights are usually needed, though elevated access may help enumerate machine-wide install paths.

#!/usr/bin/env python3
# CVE-2026-11186 Chrome version check
# Outputs: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import shutil
import subprocess
import sys

PATCH_LINUX = (149, 0, 7827, 53)
PATCH_WIN_MAC = (149, 0, 7827, 53)


def parse_version(text):
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def version_ge(a, b):
    return a >= b


def run_cmd(cmd):
    try:
        p = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, timeout=10)
        out = (p.stdout or '') + ' ' + (p.stderr or '')
        return out.strip()
    except Exception:
        return ''


def detect_linux():
    candidates = [
        shutil.which('google-chrome'),
        shutil.which('google-chrome-stable'),
        shutil.which('chromium-browser'),
        shutil.which('chromium'),
        '/opt/google/chrome/chrome',
        '/usr/bin/google-chrome',
        '/usr/bin/google-chrome-stable'
    ]
    for c in candidates:
        if c and os.path.exists(c):
            out = run_cmd([c, '--version'])
            v = parse_version(out)
            if v:
                return ('Linux', c, v, out)
    return None


def detect_macos():
    candidates = [
        '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
        os.path.expanduser('~/Applications/Google Chrome.app/Contents/MacOS/Google Chrome')
    ]
    for c in candidates:
        if os.path.exists(c):
            out = run_cmd([c, '--version'])
            v = parse_version(out)
            if v:
                return ('macOS', c, v, out)
    return None


def detect_windows():
    exe_names = []
    for base in filter(None, [
        os.environ.get('ProgramFiles'),
        os.environ.get('ProgramFiles(x86)'),
        os.environ.get('LocalAppData')
    ]):
        exe_names.append(os.path.join(base, 'Google', 'Chrome', 'Application', 'chrome.exe'))

    for c in exe_names:
        if os.path.exists(c):
            out = run_cmd([c, '--version'])
            if not out:
                ps = f"(Get-Item '{c}').VersionInfo.ProductVersion"
                out = run_cmd(['powershell', '-NoProfile', '-Command', ps])
            v = parse_version(out)
            if v:
                return ('Windows', c, v, out)
    return None


def main():
    system = platform.system().lower()
    info = None

    if 'linux' in system:
        info = detect_linux()
    elif 'darwin' in system:
        info = detect_macos()
    elif 'windows' in system:
        info = detect_windows()
    else:
        print('UNKNOWN: unsupported platform')
        sys.exit(2)

    if not info:
        print('UNKNOWN: Google Chrome not found or version unreadable')
        sys.exit(2)

    os_name, path, version, raw = info
    patch = PATCH_LINUX if os_name == 'Linux' else PATCH_WIN_MAC

    print(f'Detected platform: {os_name}')
    print(f'Executable: {path}')
    print(f'Raw version output: {raw}')
    print(f'Parsed version: {".".join(map(str, version))}')
    print(f'Patched threshold: {".".join(map(str, patch))}')

    if version_ge(version, patch):
        print('PATCHED')
        sys.exit(0)
    else:
        print('VULNERABLE')
        sys.exit(1)


if __name__ == '__main__':
    main()

Sources

1. Google Chrome Releases - Stable Channel Update for Desktop (Chrome 149)
2. Google Chrome Releases 2026 archive
3. Chromium issue 502805170
4. Chromium Security page
5. Chromium Site Isolation overview
6. FIRST EPSS overview
7. FIRST EPSS API documentation
8. CISA Known Exploited Vulnerabilities Catalog