Inappropriate implementation in MHTML in Google Chrome prior to 149

CVE-2026-11195 is a Chrome MHTML handling flaw that can leak cross-origin data when a victim is lured to a crafted HTML page and then tricked into performing *specific UI gestures*. Affected builds are Chrome versions earlier than 149.0.7827.53 on Linux and the 149.0.7827.53/54 desktop rollout on Windows/macOS; the public CVE text describes the issue as an inappropriate implementation in MHTML leading to confidentiality impact only.

Google's 6.5 / MEDIUM is defensible in lab terms because the bug crosses origin boundaries, but it overstates enterprise urgency. In the field this is constrained by user interaction, extra gesture requirements, no known exploitation, no KEV listing, no public weaponized PoC, and an impact profile limited to data exposure rather than code execution or sandbox escape.

Why this verdict

• Downgrade for user dependence: the attacker is unauthenticated and remote, but success still requires the victim to open attacker content in Chrome
• Downgrade again for exploit choreography: the CVE text adds *specific UI gestures*, which is a meaningful reliability penalty beyond ordinary UI:R browsing
• Downgrade for payoff ceiling: the advertised impact is cross-origin data leakage only, with no direct code execution, sandbox escape, persistence, or host takeover
• Downgrade for threat intel: no KEV entry, no public exploitation statement from Google, no public PoC, and an extremely low EPSS all point away from urgent weaponization
• Keep it above IGNORE: Chrome is deployed everywhere, and a same-origin bypass/data leak against live authenticated sessions can still expose tokens, portal data, or internal app content on high-value endpoints

Why not higher?

If this were a passive drive-by or paired with code execution, it would climb fast because Chrome is ubiquitous. But the exploit chain narrows hard on two friction points: the victim must both land on attacker content and perform a specific interaction sequence, and the outcome is data leakage rather than full compromise.

Why not lower?

This is still a browser-origin boundary failure in a product that exists on almost every endpoint. Even a niche, interaction-heavy leak can matter on executive, admin, and finance workstations where browser sessions hold privileged access to sensitive SaaS and internal portals.

1. Force Chrome auto-update compliance — Verify enterprise policy is actually moving endpoints to 149.0.7827.53+ on Linux and 149.0.7827.53/54+ on Windows/macOS. For a LOW verdict there is no mitigation SLA, so treat this as routine hygiene and complete it within the noisgate remediation SLA backlog window rather than emergency change control.
2. Tighten risky browsing paths — Reduce successful lure rate by enforcing Safe Browsing, URL filtering, and attachment detonation for email and chat-delivered links. This helps immediately because the exploit cannot start without the victim opening attacker content.
3. Protect high-value users first — Prioritize administrators, finance, executives, and users with privileged SaaS sessions because browser confidentiality bugs pay off most on those endpoints. Even with a LOW severity verdict, targeted-user exposure reduction is the best temporary defense until fleet patching catches up.
4. Review browser telemetry retention — Ensure you retain Chrome version inventory and basic browser-security event telemetry long enough to answer 'who was below the fixed build' during the rollout. This does not stop exploitation, but it makes post-event scoping possible.

Run this on the target endpoint or via your software-inventory agent. Invoke it with python3 check_chrome_cve_2026_11195.py; no admin rights are required if Chrome is installed in standard locations, though wider path access may help on managed images. The script checks common Chrome paths on Windows, macOS, and Linux, reads the installed version, and prints VULNERABLE, PATCHED, or UNKNOWN.

#!/usr/bin/env python3
# check_chrome_cve_2026_11195.py
# Purpose: Determine whether the locally installed Google Chrome version is
#          vulnerable to CVE-2026-11195 based on fixed version thresholds.
# Output:  VULNERABLE / PATCHED / UNKNOWN
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN

import os
import platform
import re
import shutil
import subprocess
import sys

TARGET_VERSION = (149, 0, 7827, 53)


def parse_version(text):
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def version_to_str(v):
    return '.'.join(str(x) for x in v)


def get_output(cmd):
    try:
        p = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, timeout=10)
        out = (p.stdout or '').strip()
        err = (p.stderr or '').strip()
        return out if out else err
    except Exception:
        return ''


def candidate_commands():
    system = platform.system().lower()
    cmds = []

    if system == 'windows':
        local = os.environ.get('LOCALAPPDATA', '')
        pf = os.environ.get('PROGRAMFILES', '')
        pf86 = os.environ.get('PROGRAMFILES(X86)', '')
        paths = [
            os.path.join(local, 'Google', 'Chrome', 'Application', 'chrome.exe'),
            os.path.join(pf, 'Google', 'Chrome', 'Application', 'chrome.exe'),
            os.path.join(pf86, 'Google', 'Chrome', 'Application', 'chrome.exe'),
        ]
        for p in paths:
            if p and os.path.exists(p):
                cmds.append([p, '--version'])
        where = shutil.which('chrome') or shutil.which('chrome.exe')
        if where:
            cmds.append([where, '--version'])

    elif system == 'darwin':
        app = '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'
        if os.path.exists(app):
            cmds.append([app, '--version'])
        alt = shutil.which('google-chrome')
        if alt:
            cmds.append([alt, '--version'])

    else:
        for name in ['google-chrome', 'google-chrome-stable', 'chrome', 'chromium', 'chromium-browser']:
            path = shutil.which(name)
            if path:
                cmds.append([path, '--version'])
        for p in ['/opt/google/chrome/chrome', '/usr/bin/google-chrome', '/usr/bin/google-chrome-stable']:
            if os.path.exists(p):
                cmds.append([p, '--version'])

    # de-duplicate
    seen = set()
    uniq = []
    for cmd in cmds:
        key = tuple(cmd)
        if key not in seen:
            seen.add(key)
            uniq.append(cmd)
    return uniq


def detect_version():
    for cmd in candidate_commands():
        out = get_output(cmd)
        ver = parse_version(out)
        if ver:
            return ver, ' '.join(cmd)
    return None, None


def main():
    ver, source = detect_version()
    if not ver:
        print('UNKNOWN: Google Chrome version not found from common install paths')
        sys.exit(2)

    if ver < TARGET_VERSION:
        print(f'VULNERABLE: detected Chrome {version_to_str(ver)} via {source}; fixed baseline is {version_to_str(TARGET_VERSION)} or later')
        sys.exit(1)
    else:
        print(f'PATCHED: detected Chrome {version_to_str(ver)} via {source}; meets or exceeds fixed baseline {version_to_str(TARGET_VERSION)}')
        sys.exit(0)


if __name__ == '__main__':
    main()

Sources

1. Google Chrome Releases - Stable Channel Update for Desktop (June 2, 2026)
2. Chromium issue 503865896
3. Vulnerability Lookup / CVE List mirror for CVE-2026-11195
4. Canadian Centre for Cyber Security advisory AV26-544
5. CISA Known Exploited Vulnerabilities Catalog
6. FIRST EPSS overview
7. FIRST EPSS API documentation
8. Chromium Site Isolation overview