Inappropriate implementation in WebRTC in Google Chrome prior to 149

CVE-2026-11199 is a WebRTC implementation flaw in Google Chrome that affects versions prior to 149.0.7827.53. The stated impact is *cross-origin data leakage* caused by *malicious network traffic*, which means the attacker is not abusing a normal web page alone; they need to be in a privileged network position where they can observe, alter, or inject traffic into the victim's WebRTC-related flows.

Google's MEDIUM 5.9 label is fair on pure technical severity, but it still reads hotter than the operational reality for most enterprises. The decisive friction is the attacker position: *privileged network attacker* is a narrow prerequisite that usually implies a compromised Wi-Fi, malicious ISP/proxy/VPN node, or already-compromised internal network gear. That sharply reduces reachable population compared with the usual Chrome bugs that only need a crafted page.

Why this verdict

• Downward pressure: attacker must already control the network path — unauthenticated remote on the open internet is *not* enough; this implies hostile Wi-Fi, compromised proxy/VPN, or upstream interception.
• Downward pressure: reachability is narrow — a client-side browser bug cannot be internet-scanned like a server CVE, and only endpoints both running old Chrome and traversing the wrong network conditions are realistically exposed.
• Downward pressure: modern controls can break the chain — secure VPNs, trusted egress, NAC, rogue AP detection, network segmentation, and identity/session anomaly controls all reduce real-world abuse.
• Downward pressure: impact is confidentiality-only — there is no published integrity or availability effect, and no browser sandbox escape or arbitrary code execution.
• Downward pressure: exploit development looks non-trivial — CVSS marks attack complexity high, the advisory calls for malicious network traffic, and no public PoC was found.
• Small upward pressure: Chrome is everywhere — ubiquity matters, but ubiquity alone does not overcome the on-path requirement.

Why not higher?

If this were a standard crafted-page bug with UI:R or UI:N and no special attacker position, it would stay in MEDIUM. But here the advisory itself narrows the threat to a privileged network attacker, which compounds with high complexity and no public exploitation. That combination kills the mass-exploitation story.

Why not lower?

It is still a real browser confidentiality flaw in a ubiquitous product, and some enterprise users do operate on untrusted hotel, airport, coffee-shop, contractor, or BYOD-adjacent networks. If an attacker does own that path, the bug removes a browser isolation guarantee and can expose sensitive cross-origin data.

1. Force browser auto-update — Make sure Chrome update enforcement is intact across managed endpoints so old builds age out naturally. For a LOW verdict there is no mitigation SLA and no special rush window; treat this as backlog hygiene and use standard endpoint compliance cycles.
2. Prefer trusted egress paths — Route users through managed VPN, secure web gateway, or known-good enterprise egress when possible, especially for roaming users. This directly cuts the main attack prerequisite by removing attacker-controlled network positions; for LOW, apply as part of routine hardening rather than emergency change work.
3. Restrict unnecessary WebRTC exposure — Where business use allows it, reduce or control WebRTC usage through enterprise browser policy, extension governance, or app allow-listing. This shrinks the vulnerable code-path population without waiting for perfect patch coverage.
4. Monitor for rogue network behavior — Watch for ARP spoofing, rogue DHCP, suspicious transparent proxies, anomalous STUN/TURN traffic, and unusual session reuse in SaaS or IdP logs. This will not prevent the bug by itself, but it is the best way to catch the prerequisite network compromise early.

Run this on the target endpoint or through your software inventory agent. Invoke it as python3 check_chrome_cve_2026_11199.py on macOS/Linux or py check_chrome_cve_2026_11199.py on Windows; no admin rights are required for basic local checks, but broader filesystem visibility may improve detection on shared systems.

#!/usr/bin/env python3\n# Check for CVE-2026-11199 exposure by verifying installed Google Chrome version\n# Affected: Chrome < 149.0.7827.53\n# Fixed:    Chrome >= 149.0.7827.53\n# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN\n\nimport os\nimport platform\nimport re\nimport shutil\nimport subprocess\nimport sys\nfrom typing import Optional, Tuple\n\nFIXED = (149, 0, 7827, 53)\n\ndef parse_version(text: str) -> Optional[Tuple[int, int, int, int]]:\n    m = re.search(r'(\\d+)\\.(\\d+)\\.(\\d+)\\.(\\d+)', text)\n    if not m:\n        return None\n    return tuple(int(x) for x in m.groups())\n\ndef run_cmd(cmd):\n    try:\n        p = subprocess.run(cmd, capture_output=True, text=True, timeout=10)\n        out = (p.stdout or '') + (p.stderr or '')\n        return out.strip()\n    except Exception:\n        return ''\n\ndef get_windows_version() -> Optional[Tuple[int, int, int, int]]:\n    candidates = [\n        os.path.expandvars(r'%ProgramFiles%\\Google\\Chrome\\Application\\chrome.exe'),\n        os.path.expandvars(r'%ProgramFiles(x86)%\\Google\\Chrome\\Application\\chrome.exe'),\n        os.path.expandvars(r'%LocalAppData%\\Google\\Chrome\\Application\\chrome.exe'),\n    ]\n    ps = shutil.which('powershell') or shutil.which('pwsh')\n    for path in candidates:\n        if path and os.path.exists(path) and ps:\n            cmd = [ps, '-NoProfile', '-Command', f\"(Get-Item '{path.replace('\\\\', '\\\\\\\\')}').VersionInfo.ProductVersion\"]\n            out = run_cmd(cmd)\n            ver = parse_version(out)\n            if ver:\n                return ver\n    return None\n\ndef get_macos_version() -> Optional[Tuple[int, int, int, int]]:\n    app = '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'\n    if os.path.exists(app):\n        out = run_cmd([app, '--version'])\n        ver = parse_version(out)\n        if ver:\n            return ver\n    return None\n\ndef get_linux_version() -> Optional[Tuple[int, int, int, int]]:\n    for binary in ['google-chrome', 'google-chrome-stable', 'chromium', 'chromium-browser']:\n        path = shutil.which(binary)\n        if path:\n            out = run_cmd([path, '--version'])\n            ver = parse_version(out)\n            if ver:\n                return ver\n    return None\n\ndef compare(a, b):\n    return (a > b) - (a < b)\n\ndef main():\n    system = platform.system().lower()\n    version = None\n\n    if 'windows' in system:\n        version = get_windows_version()\n    elif 'darwin' in system:\n        version = get_macos_version()\n    elif 'linux' in system:\n        version = get_linux_version()\n\n    if not version:\n        print('UNKNOWN - Google Chrome version could not be determined on this host')\n        sys.exit(2)\n\n    version_str = '.'.join(str(x) for x in version)\n    fixed_str = '.'.join(str(x) for x in FIXED)\n\n    if compare(version, FIXED) < 0:\n        print(f'VULNERABLE - Detected Chrome {version_str}; fixed version is {fixed_str} or later')\n        sys.exit(1)\n    else:\n        print(f'PATCHED - Detected Chrome {version_str}; fixed version is {fixed_str}')\n        sys.exit(0)\n\nif __name__ == '__main__':\n    main()\n

Sources

1. Google Chrome Releases - Early Stable Update for Desktop
2. CVE Record
3. CIRCL Vulnerability Lookup entry
4. Chromium issue reference
5. CISA Known Exploited Vulnerabilities Catalog
6. FIRST EPSS overview
7. FIRST EPSS API documentation