Insufficient policy enforcement in Password Manager in Google Chrome prior to 149

CVE-2026-11193 is an *insufficient policy enforcement* flaw in Chrome Password Manager. Google says Chrome versions *before* 149.0.7827.53 are affected; the stable desktop release shipped as 149.0.7827.53 for Linux and 149.0.7827.53/.54 for Windows and macOS. The attack is delivered through a crafted HTML page, so the vulnerable component is the browser endpoint, not an internet-facing server.

Google's 6.5 MEDIUM is basically fair, and if anything slightly generous for enterprise prioritization. The downdraft is simple: exploitation requires a user to land on attacker content, the bug sits inside a specific feature area of the browser, and the published scoring shows *no confidentiality or integrity impact*—only availability. That makes this an endpoint hygiene problem, not an emergency incident-driver.

Why this verdict

• User interaction drags this down: the attacker needs a victim to load a crafted HTML page, which implies phishing, malvertising, or a compromised site rather than silent network exploitation.
• Feature scope matters: this is in *Password Manager*, and many enterprises either disable that feature or steer users into a separate enterprise vault, shrinking the reachable population.
• Published impact is not takeover-grade: the vendor/CISA-adjacent scoring is C:N/I:N/A:H, so this is not a browser RCE, sandbox escape, or credential disclosure bug based on the evidence currently public.
• Exploit demand is weak right now: no KEV listing, no public PoC found, and EPSS is extremely low.
• Exposure is endpoint-local, not server-external: there is no mass internet attack surface to sweep with commodity scanners, which sharply reduces opportunistic exploitation at scale.

Why not higher?

To justify HIGH here, I would want either *active exploitation*, a public PoC with reliable abuse, or a stronger impact class such as data theft, account compromise, or code execution. We have none of that. The chain also compounds friction: user interaction first, feature-specific reach second, then a local browser-side impact rather than an enterprise control-plane break.

Why not lower?

I am not pushing this to LOW because Chrome is everywhere and web-delivered bugs can still scale quickly once lures are in the wild. Even with weak attacker demand, a vulnerable browser fleet is a real estate problem, and the attack precondition of 'open a page' is still common enough to merit routine remediation rather than documentation-only dismissal.

1. Enforce Chrome auto-update compliance — Make sure browser update policy is actually landing and that endpoints are not pinned behind broken rings. For a MEDIUM verdict there is no mitigation SLA — go straight to the 365-day remediation window, but in practice browser compliance should be verified in your next normal endpoint cycle because dwell time is what turns browser bugs into incident volume.
2. Audit PasswordManagerEnabled policy — If your standard is to use an enterprise password vault instead of Chrome Password Manager, verify the policy is consistently disabled across managed browsers. This does not replace patching, but it can reduce reachable exposure while you work through normal remediation.
3. Keep Safe Browsing and web filtering on — This bug needs delivery through attacker-controlled HTML, so web-phishing controls still matter. Use them to suppress lure delivery and malicious destinations while patching proceeds under the MEDIUM 365-day remediation window.
4. Use browser inventory, not network scans — Track version state with EDR, MDM, Chrome Browser Cloud Management, SCCM/Intune, or similar tooling. Internet-facing scanners will not tell you which users have vulnerable browser builds.

Run this on the target endpoint or through your software-inventory/EDR remote execution channel. Invoke it with python3 check_chrome_cve_2026_11193.py; no admin rights are usually needed unless your EDR wrapper requires them. The script checks common install locations on Windows, macOS, and Linux and compares the discovered browser version to the fixed baseline 149.0.7827.53.

#!/usr/bin/env python3
# check_chrome_cve_2026_11193.py
# Outputs: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import subprocess
import sys
from shutil import which

FIXED = (149, 0, 7827, 53)
CANDIDATES = []

SYSTEM = platform.system().lower()

if SYSTEM == 'windows':
    local = os.environ.get('LOCALAPPDATA', '')
    program_files = os.environ.get('ProgramFiles', '')
    program_files_x86 = os.environ.get('ProgramFiles(x86)', '')
    CANDIDATES = [
        os.path.join(local, 'Google', 'Chrome', 'Application', 'chrome.exe'),
        os.path.join(program_files, 'Google', 'Chrome', 'Application', 'chrome.exe'),
        os.path.join(program_files_x86, 'Google', 'Chrome', 'Application', 'chrome.exe'),
        os.path.join(local, 'Chromium', 'Application', 'chrome.exe'),
    ]
elif SYSTEM == 'darwin':
    CANDIDATES = [
        '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
        os.path.expanduser('~/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'),
        '/Applications/Chromium.app/Contents/MacOS/Chromium',
    ]
else:
    CANDIDATES = [
        '/usr/bin/google-chrome',
        '/usr/bin/google-chrome-stable',
        '/usr/bin/chromium',
        '/usr/bin/chromium-browser',
        '/snap/bin/chromium',
        which('google-chrome') or '',
        which('google-chrome-stable') or '',
        which('chromium') or '',
        which('chromium-browser') or '',
    ]


def parse_version(text):
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def get_version_from_binary(path):
    try:
        result = subprocess.run([path, '--version'], capture_output=True, text=True, timeout=10)
        output = (result.stdout or '') + ' ' + (result.stderr or '')
        return parse_version(output)
    except Exception:
        return None


def compare_versions(a, b):
    return (a > b) - (a < b)


seen = []
for candidate in CANDIDATES:
    if candidate and os.path.exists(candidate):
        ver = get_version_from_binary(candidate)
        if ver:
            seen.append((candidate, ver))

if not seen:
    print('UNKNOWN: Chrome/Chromium binary not found in common locations')
    sys.exit(2)

# Use the highest discovered version if multiple are installed.
path, version = sorted(seen, key=lambda x: x[1], reverse=True)[0]
version_str = '.'.join(str(x) for x in version)
fixed_str = '.'.join(str(x) for x in FIXED)

if compare_versions(version, FIXED) >= 0:
    print(f'PATCHED: {path} -> {version_str} (fixed baseline {fixed_str})')
    sys.exit(0)
else:
    print(f'VULNERABLE: {path} -> {version_str} (needs >= {fixed_str})')
    sys.exit(1)

Sources

1. Google Chrome Releases - Stable Channel Update for Desktop (June 2, 2026)
2. Chromium issue tracker - issue 503642586
3. GitHub Advisory Database - GHSA-cw7x-6q47-qrj7
4. CIRCL Vulnerability-Lookup - CVE-2026-11193
5. NVD - CVE-2026-11193
6. CISA Known Exploited Vulnerabilities Catalog
7. Chrome Enterprise Help - Security and privacy policies
8. Chrome Enterprise Help - Set up active password detection