Out of bounds memory access in ANGLE in Google Chrome prior to 149

CVE-2026-11191 is an out-of-bounds memory access bug in ANGLE, Chrome's graphics translation layer, reachable by getting a user to render attacker-controlled web content. The authoritative affected range is Google Chrome before 149.0.7827.53 on Linux and Windows, and before 149.0.7827.54 on Mac, based on Google's June 2, 2026 stable release and the earlier May 29, 2026 early-stable push.

The vendor baseline of 8.8/HIGH overstates enterprise urgency. In practice this is a client-side, user-driven, single-bug browser memory issue with no KEV listing, no confirmed in-the-wild exploitation, no public PoC, and an important vendor-side tell: Google itself labeled the bug's Chromium security severity as Medium. The big downward pressure is that a lone browser renderer/GPU bug usually needs a second-stage primitive or sandbox escape to become an estate-wide emergency.

Why this verdict

• Vendor 8.8 starts too high for reality because CVSS gives full CIA credit, while the published record only confirms out-of-bounds access in a browser component and Google's own Chromium severity says *Medium*.
• Requires user interaction: the attacker cannot just hit an internet-facing service; they must get a victim to render malicious web content, which means phishing, malvertising, or site compromise first.
• Sandbox/process isolation is the main downward adjustment: to turn a browser-process memory bug into full endpoint compromise, the attacker usually needs a second bug or escape stage that is not part of this CVE.
• No exploitation signal: no KEV listing, no public campaign reporting, no exploit kit chatter surfaced, and no public PoC materially reduce short-term operational risk.
• Population is huge but blast radius per trigger is local: yes, Chrome is everywhere, but exploitation is one-user-at-a-time, not one-packet-to-10,000-hosts.

Why not higher?

There is no evidence this CVE alone provides a clean path to host takeover, domain impact, or wormable propagation. The combination of required user interaction, absent public weaponization, and likely sandbox containment keeps this out of HIGH territory.

Why not lower?

It is still a remotely reachable browser memory-safety flaw in a ubiquitous enterprise application. If a user visits hostile content on an unpatched build, the bug is reachable, and memory bugs in browser graphics code are never noise-level backlog items.

1. Enforce browser auto-update — Make sure enterprise policy forces Chrome to update and relaunch so vulnerable builds age out quickly. For a MEDIUM verdict there is no mitigation SLA — go straight to the 365-day remediation window, but in practice you should let normal browser update controls do the work now rather than waiting for an annual cleanup cycle.
2. Prefer browser isolation for high-risk users — Put admins, finance, executives, and help-desk staff behind remote/browser isolation for unknown sites and email-delivered links. There is no mitigation SLA for MEDIUM here, so use this as a targeted exposure reducer until patched versions are universal inside the remediation window.
3. Harden risky web content paths — Use secure web gateway policy, Safe Browsing, attachment detonation, and ad/tracker filtering to cut down delivery of hostile pages that would need to trigger the bug. This matters because the first real friction point is getting a user onto attacker-controlled content.
4. Watch for browser crash anomalies — Trend Chrome renderer/GPU-process crashes and exploit-protection events in EDR/SIEM, especially after suspicious link clicks or on high-risk user groups. This will not prove exploitation, but it can surface attempted trigger activity while patch compliance catches up.

Run this on the target endpoint or through your software-distribution/EDR execution framework. Invoke it as python3 chrome_cve_2026_11191_check.py on macOS/Linux or py chrome_cve_2026_11191_check.py on Windows; standard user rights are usually enough because it only reads local version metadata.

#!/usr/bin/env python3
# CVE-2026-11191 Chrome version check
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN

import os
import platform
import re
import subprocess
import sys
from shutil import which

TARGET = (149, 0, 7827, 53)
MAC_TARGET = (149, 0, 7827, 54)


def norm(v):
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', v or '')
    return tuple(int(x) for x in m.groups()) if m else None


def cmp_ver(a, b):
    return (a > b) - (a < b)


def run_cmd(cmd):
    try:
        p = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, timeout=10)
        if p.returncode == 0:
            return p.stdout.strip() or p.stderr.strip()
    except Exception:
        pass
    return None


def candidates_windows():
    local = os.environ.get('LOCALAPPDATA', '')
    pf = os.environ.get('ProgramFiles', '')
    pfx86 = os.environ.get('ProgramFiles(x86)', '')
    return [
        os.path.join(local, 'Google', 'Chrome', 'Application', 'chrome.exe'),
        os.path.join(pf, 'Google', 'Chrome', 'Application', 'chrome.exe'),
        os.path.join(pfx86, 'Google', 'Chrome', 'Application', 'chrome.exe'),
        os.path.join(local, 'Chromium', 'Application', 'chrome.exe'),
        os.path.join(pf, 'Chromium', 'Application', 'chrome.exe'),
        os.path.join(pfx86, 'Chromium', 'Application', 'chrome.exe'),
    ]


def candidates_macos():
    return [
        '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
        '/Applications/Chromium.app/Contents/MacOS/Chromium',
        os.path.expanduser('~/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'),
        os.path.expanduser('~/Applications/Chromium.app/Contents/MacOS/Chromium'),
    ]


def candidates_linux():
    paths = []
    for name in ['google-chrome', 'google-chrome-stable', 'chromium', 'chromium-browser', 'chrome']:
        p = which(name)
        if p:
            paths.append(p)
    paths += [
        '/usr/bin/google-chrome',
        '/usr/bin/google-chrome-stable',
        '/usr/bin/chromium',
        '/usr/bin/chromium-browser',
        '/snap/bin/chromium',
    ]
    return paths


def get_version_from_binary(path):
    if not path or not os.path.exists(path):
        return None
    out = run_cmd([path, '--version'])
    if out:
        return norm(out)
    return None


def get_version_windows_ps(path):
    if not path or not os.path.exists(path):
        return None
    ps = which('powershell') or which('pwsh')
    if not ps:
        return None
    cmd = [ps, '-NoProfile', '-Command', f"(Get-Item '{path}').VersionInfo.ProductVersion"]
    out = run_cmd(cmd)
    return norm(out) if out else None


def find_installed_version():
    sysname = platform.system()

    if sysname == 'Windows':
        for p in candidates_windows():
            v = get_version_windows_ps(p) or get_version_from_binary(p)
            if v:
                return ('Windows', p, v)

    elif sysname == 'Darwin':
        for p in candidates_macos():
            v = get_version_from_binary(p)
            if v:
                return ('Darwin', p, v)

    else:
        for p in candidates_linux():
            v = get_version_from_binary(p)
            if v:
                return ('Linux', p, v)

    return (sysname, None, None)


def main():
    sysname, path, version = find_installed_version()
    if not version:
        print('UNKNOWN')
        print(f'platform={sysname} reason=chrome_not_found_or_version_unreadable')
        sys.exit(2)

    fixed = MAC_TARGET if sysname == 'Darwin' else TARGET
    status = 'PATCHED' if cmp_ver(version, fixed) >= 0 else 'VULNERABLE'

    print(status)
    print(f'platform={sysname} path={path} version={".".join(map(str, version))} fixed={".".join(map(str, fixed))}')

    if status == 'PATCHED':
        sys.exit(0)
    else:
        sys.exit(1)


if __name__ == '__main__':
    main()

Sources

1. Google Chrome Stable Channel Update for Desktop
2. Google Chrome Early Stable Update for Desktop
3. Chromium Issue 503392431
4. CIRCL Vulnerability Lookup for CVE-2026-11191
5. CISA Known Exploited Vulnerabilities Catalog
6. FIRST EPSS API documentation
7. NVD entry for CVE-2026-11191
8. GitHub Advisory GHSA-r79w-gpv4-pww2