Insufficient validation of untrusted input in Codecs in Google Chrome prior to 149

CVE-2026-11198 is an input-validation flaw in Chrome's Codecs component that affects Chrome builds prior to 149.0.7827.53 on Linux and prior to 149.0.7827.53/.54 on Windows and macOS. The public description says a remote attacker could *potentially* achieve a sandbox escape through a crafted video file, which makes this a client-side content-parsing issue rather than an always-reachable service flaw.

The supplied CRITICAL 9.6 label overstates operational risk for most enterprises. In the real world this requires a user to render attacker-controlled media, hits one endpoint at a time, has no KEV listing, no public exploit chain, a very low supplied EPSS, and even Chrome's own CNA text marks it as Chromium security severity: Medium.

Why this verdict

• Down from 9.6 because UI:R is real friction — the attacker needs a user to open or render malicious media, which pushes this out of wormable/server-exposed territory and into phishing or web-lure tradecraft.
• Down again because the hardest step is the one that matters — turning a codec parsing bug into a reliable *sandbox escape* is materially harder than crashing a browser process, and there is no public chain showing that reliability.
• Down again because exploitation pressure is weak — no KEV entry, no public PoC found, and the supplied EPSS is only 0.0009.
• Not lower because Chrome is everywhere — Chrome has enormous enterprise reach, so even a client-side bug with friction can still matter if your patch hygiene is poor.
• Not lower because the stated outcome is serious if achieved — a successful sandbox escape on a user workstation is a meaningful endpoint compromise, just not the same operational class as an unauthenticated internet-facing server RCE.

Why not higher?

There is no evidence this is being exploited in the wild, no public weaponization, and the chain requires user-driven content rendering. Most importantly, the vulnerability's scariest word is *potentially*: the public description does not demonstrate a mature, reliable exploit path through Chrome's sandbox protections.

Why not lower?

This still sits in a massively deployed browser, and the affected component processes untrusted content from the internet by design. If an exploit chain emerges, the path to endpoint compromise is straightforward enough that this cannot be treated as mere backlog hygiene.

1. Verify browser auto-update health — Confirm managed Chrome update channels, version reporting, and stalled-updater exceptions across the fleet so vulnerable endpoints do not linger. For a MEDIUM verdict there is no mitigation SLA — go straight to the 365-day remediation window, but this control should be validated in the next regular endpoint engineering cycle because browsers age badly.
2. Reduce risky content delivery — Tighten web filtering, attachment detonation, and download reputation checks for unsolicited media payloads and newly registered lure domains. There is no mitigation SLA for MEDIUM, but use the normal remediation window to shrink exposure while patched browser versions propagate.
3. Harden endpoint post-exploitation controls — Ensure EDR prevention, application control, and browser child-process restrictions are enabled so a successful browser escape does not become durable host compromise. For MEDIUM, fold this into standard hardening work rather than an emergency change.
4. Inventory vulnerable versions — Use endpoint management, software inventory, or the verification script below to identify Chrome builds older than 149.0.7827.53/.54. With no mitigation SLA for MEDIUM, the priority is clean scoping and steady patch closure inside the remediation window.

Run this on the target endpoint or through your endpoint management tool. Invoke it as python3 chrome_cve_2026_11198_check.py on Linux/macOS or py chrome_cve_2026_11198_check.py on Windows; no admin rights are normally required, though broader path/registry visibility on locked-down systems may help.

#!/usr/bin/env python3
# CVE-2026-11198 Chrome version check
# Outputs: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 1=vulnerable, 0=patched, 2=unknown

import os
import platform
import re
import shutil
import subprocess
import sys

TARGET = (149, 0, 7827, 53)


def parse_version(text):
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def version_lt(a, b):
    return a < b


def run_cmd(cmd):
    try:
        p = subprocess.run(cmd, capture_output=True, text=True, timeout=5)
        out = (p.stdout or '') + ' ' + (p.stderr or '')
        return out.strip()
    except Exception:
        return ''


def candidate_paths():
    system = platform.system().lower()
    paths = []

    if system == 'windows':
        local = os.environ.get('LOCALAPPDATA', '')
        program_files = os.environ.get('ProgramFiles', '')
        program_files_x86 = os.environ.get('ProgramFiles(x86)', '')
        paths.extend([
            os.path.join(local, 'Google', 'Chrome', 'Application', 'chrome.exe'),
            os.path.join(program_files, 'Google', 'Chrome', 'Application', 'chrome.exe'),
            os.path.join(program_files_x86, 'Google', 'Chrome', 'Application', 'chrome.exe'),
        ])
    elif system == 'darwin':
        paths.extend([
            '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
            os.path.expanduser('~/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'),
        ])
    else:
        for name in ['google-chrome', 'google-chrome-stable', 'chromium', 'chromium-browser', 'chrome']:
            p = shutil.which(name)
            if p:
                paths.append(p)
        paths.extend([
            '/usr/bin/google-chrome',
            '/usr/bin/google-chrome-stable',
            '/opt/google/chrome/chrome',
            '/usr/bin/chromium',
            '/usr/bin/chromium-browser',
        ])

    seen = []
    for p in paths:
        if p and p not in seen:
            seen.append(p)
    return seen


def get_windows_registry_version():
    try:
        import winreg
    except Exception:
        return None

    keys = [
        r'SOFTWARE\Google\Chrome\BLBeacon',
        r'SOFTWARE\WOW6432Node\Google\Chrome\BLBeacon',
    ]
    hives = []
    try:
        hives.append(winreg.HKEY_CURRENT_USER)
        hives.append(winreg.HKEY_LOCAL_MACHINE)
    except Exception:
        return None

    for hive in hives:
        for key in keys:
            try:
                with winreg.OpenKey(hive, key) as k:
                    value, _ = winreg.QueryValueEx(k, 'version')
                    ver = parse_version(str(value))
                    if ver:
                        return ver
            except Exception:
                continue
    return None


def detect_versions():
    found = []

    if platform.system().lower() == 'windows':
        reg_ver = get_windows_registry_version()
        if reg_ver:
            found.append(('registry', reg_ver))

    for path in candidate_paths():
        if not os.path.exists(path):
            continue
        out = run_cmd([path, '--version'])
        ver = parse_version(out)
        if ver:
            found.append((path, ver))

    return found


def main():
    found = detect_versions()
    if not found:
        print('UNKNOWN: Google Chrome version could not be determined on this host')
        sys.exit(2)

    lowest = min(ver for _, ver in found)
    details = ', '.join([f'{src}={".".join(map(str, ver))}' for src, ver in found])

    if version_lt(lowest, TARGET):
        print(f'VULNERABLE: found Chrome version(s) below 149.0.7827.53 ({details})')
        sys.exit(1)
    else:
        print(f'PATCHED: found Chrome version(s) at or above 149.0.7827.53 ({details})')
        sys.exit(0)


if __name__ == '__main__':
    main()

Sources

1. Chrome Releases - Stable Channel Update for Desktop
2. Chrome Releases - Early Stable Update for Desktop
3. Vulnerability-Lookup - CVE-2026-11198
4. Chromium issue 504395300
5. CISA Known Exploited Vulnerabilities Catalog
6. FIRST EPSS API documentation
7. StatCounter browser market share worldwide
8. Canadian Centre for Cyber Security advisory AV26-544