Type Confusion in XML in Google Chrome prior to 149

CVE-2026-11196 is a Chrome XML/XSLT parsing flaw classified as type confusion (CWE-843). A remote attacker can feed a victim crafted XML content and, if the victim opens it in vulnerable Chrome, potentially read sensitive data from browser process memory. The affected range is Chrome versions prior to 149.0.7827.53 on Linux and prior to 149.0.7827.53/54 on Windows and macOS; Google shipped the stable fix on 2026-06-02 and the CVE record was published on 2026-06-04.

The vendor's MEDIUM 6.5 is basically fair. Yes, Chrome is everywhere and the attacker can deliver this over the internet, but the chain still depends on user interaction and the published impact is *information disclosure*, not code execution or sandbox escape. In real enterprise fleets, that combination usually lands in the "patch through normal browser governance, but don't panic" bucket.

Why this verdict

• User interaction cuts the chain: attacker position starts as unauthenticated remote, but exploitation still requires the victim to open attacker-controlled XML/XSLT content. That prerequisite implies dependence on phishing, download, or lure success, and modern email/web controls should stop a meaningful fraction of attempts.
• Impact is a leak, not code exec: the published outcome is sensitive memory disclosure from Chrome process memory. That is materially less operationally dangerous than an RCE or sandbox escape with the same delivery path.
• Population is huge, but exposure is not mass-scannable: Chrome is widely deployed, which supports keeping this above LOW, yet there is no internet-facing service to enumerate and spray at scale. Real defenders have to manage this as endpoint software hygiene, not perimeter emergency response.
• Threat intel is cold: no KEV listing, no public exploitation evidence, no public PoC found, and the EPSS signal is low. Those are all downward pressures from the 6.5 baseline.
• Enterprise update mechanics help defenders: Chrome has mature auto-update and relaunch controls in managed environments. That doesn't erase the bug, but it reduces the size and dwell time of the vulnerable population when browser governance is healthy.

Why not higher?

There is no evidence here of code execution, sandbox escape, wormability, or active exploitation. The exploit chain narrows immediately at the user-interaction step, then narrows again because the attacker still has to convert a memory disclosure into useful secrets and then into business impact.

Why not lower?

I would not drop this to LOW because Chrome is one of the most exposed applications in the fleet and remote delivery is trivial. Even a confidentiality-only browser bug can matter for targeted users if the leaked process memory includes tokens, page contents, or other sensitive session material.

1. Keep Chrome auto-update on — Validate that managed browsers are not pinned behind the fixed build and that relaunch prompts are enforced. For a MEDIUM verdict there is no mitigation SLA — go straight to the 365-day remediation window, but in practice this should simply ride your normal Chrome update channel without creating stragglers.
2. Block untrusted XML attachments — Tune email and web controls to quarantine or warn on unsolicited .xml, .xsl, and similar content from external sources. There is no mitigation SLA for a MEDIUM finding, but this is a cheap exposure reducer while the fleet naturally rolls onto the patched browser build.
3. Enforce relaunch compliance — A lot of Chrome fleets look patched in inventory while users keep old renderer processes alive for days. Use browser relaunch notifications or device restart policy so the fixed binary actually becomes the running binary; with MEDIUM, there is no mitigation SLA — go straight to remediation tracking.
4. Watch high-risk user groups — Prioritize executives, finance, admins, developers, and users regularly targeted by phishing for version verification and suspicious browser event review. This is where a memory-disclosure bug is most likely to translate into something that matters.

Run this on the target endpoint or through your endpoint management tooling. Invoke it as python3 chrome_cve_2026_11196_check.py; no admin rights are required, but the script needs permission to execute the local Chrome binary or read standard install paths. It checks common Windows, macOS, and Linux locations and prints VULNERABLE, PATCHED, or UNKNOWN.

#!/usr/bin/env python3
# CVE-2026-11196 Chrome version check
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import shutil
import subprocess
import sys

FIXED = (149, 0, 7827, 53)


def parse_version(s):
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', s or '')
    return tuple(map(int, m.groups())) if m else None


def version_ge(a, b):
    return a >= b


def get_output(cmd):
    try:
        p = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, timeout=10)
        out = (p.stdout or '') + ' ' + (p.stderr or '')
        return out.strip()
    except Exception:
        return ''


def candidate_commands():
    system = platform.system().lower()
    cmds = []

    if system == 'windows':
        local = os.environ.get('LOCALAPPDATA', '')
        pf = os.environ.get('PROGRAMFILES', '')
        pf86 = os.environ.get('PROGRAMFILES(X86)', '')
        paths = [
            os.path.join(local, 'Google', 'Chrome', 'Application', 'chrome.exe'),
            os.path.join(pf, 'Google', 'Chrome', 'Application', 'chrome.exe'),
            os.path.join(pf86, 'Google', 'Chrome', 'Application', 'chrome.exe'),
        ]
        for p in paths:
            if p and os.path.exists(p):
                cmds.append([p, '--version'])
    elif system == 'darwin':
        paths = [
            '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
            os.path.expanduser('~/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'),
        ]
        for p in paths:
            if os.path.exists(p):
                cmds.append([p, '--version'])
    else:
        names = ['google-chrome', 'google-chrome-stable', 'chromium', 'chromium-browser']
        for name in names:
            path = shutil.which(name)
            if path:
                cmds.append([path, '--version'])
        linux_paths = [
            '/opt/google/chrome/chrome',
            '/usr/bin/google-chrome',
            '/usr/bin/google-chrome-stable',
            '/snap/bin/chromium',
            '/usr/bin/chromium',
            '/usr/bin/chromium-browser',
        ]
        for p in linux_paths:
            if os.path.exists(p):
                cmds.append([p, '--version'])

    # de-duplicate while preserving order
    seen = set()
    unique = []
    for cmd in cmds:
        key = tuple(cmd)
        if key not in seen:
            seen.add(key)
            unique.append(cmd)
    return unique


def main():
    cmds = candidate_commands()
    found_versions = []

    for cmd in cmds:
        out = get_output(cmd)
        ver = parse_version(out)
        if ver:
            found_versions.append((cmd[0], ver, out))

    if not found_versions:
        print('UNKNOWN - Chrome executable/version not found in common locations')
        sys.exit(2)

    # If multiple installs exist, judge the newest discovered version but print all
    newest = max(v for _, v, _ in found_versions)
    detail = '; '.join([f'{path} => {ver[0]}.{ver[1]}.{ver[2]}.{ver[3]}' for path, ver, _ in found_versions])

    if version_ge(newest, FIXED):
        print(f'PATCHED - found {detail}; fixed threshold is {FIXED[0]}.{FIXED[1]}.{FIXED[2]}.{FIXED[3]}')
        sys.exit(0)
    else:
        print(f'VULNERABLE - found {detail}; fixed threshold is {FIXED[0]}.{FIXED[1]}.{FIXED[2]}.{FIXED[3]}')
        sys.exit(1)


if __name__ == '__main__':
    main()

Sources

1. Google Chrome stable desktop update
2. Chromium issue 503879106
3. GitHub Advisory Database entry
4. Chrome 149 release notes
5. CISA Known Exploited Vulnerabilities Catalog
6. FIRST EPSS API documentation
7. Chrome Enterprise update management guidance
8. Public CVE aggregation with CNA/NVD metadata