Use after free in ServiceWorker in Google Chrome prior to 149

CVE-2026-11201 is a use-after-free in Chrome ServiceWorker affecting Google Chrome versions before 149.0.7827.53. The published description matters: the attacker must convince a user to install a malicious Chrome extension, and that crafted extension then triggers the memory-corruption bug to reach arbitrary code execution in the browser context. Official Chrome release notes list it as Chromium security severity: Medium, even though downstream CVSS scoring shows 8.8 High.

The vendor-style CVSS is too generous for enterprise prioritization because it treats this like generic network-reachable browser RCE. In reality, the exploit chain begins with a malicious extension install prerequisite, which is a major friction point in managed fleets: extension allowlists, admin install policies, user awareness, Safe Browsing, and store vetting all narrow the reachable population before the bug is even in play.

Why this verdict

• Major prerequisite discount: attacker needs the victim to install a malicious extension first; that is not the same thing as unauthenticated drive-by web exploitation.
• Exposure discount: only endpoints running Chrome < 149.0.7827.53 *and* lacking strong extension governance are realistically reachable.
• Threat-intel discount: no KEV, no public PoC, and 0.009% EPSS / 1st percentile all push this below a typical browser-RCE emergency.

Why not higher?

A higher rating would make sense for a pure drive-by browser bug with active exploitation or a reliable public exploit. This one is bottlenecked by the need to land a malicious extension first, which means many enterprises can eliminate most of the reachable population with policy alone.

Why not lower?

It is still a memory-corruption code-execution bug in Chrome, and Chrome is everywhere. If your fleet allows broad extension installs, or you have a history of users adopting unsanctioned add-ons, the reachable population grows quickly and the residual risk stays meaningful.

1. Lock down extension installs — Enforce extension allowlists / blocklists in Chrome enterprise policy and remove user ability to install arbitrary add-ons where business-acceptable. For a MEDIUM verdict there is no mitigation SLA; use this as an immediate risk-reducer for high-risk user groups while completing remediation within 365 days.
2. Inventory and review installed extensions — Pull extension inventories from browser management, EDR, or MDM, then flag rare, newly installed, sideloaded, or unapproved extension IDs. There is no mitigation SLA here; do the review now for unmanaged cohorts and keep it as an interim control until patched builds are universal within the 365-day remediation window.
3. Verify Chrome auto-update health — Find systems pinned below 149.0.7827.53 because of broken update channels, VDI gold images, packaging lag, or deferred rings. There is no mitigation SLA for MEDIUM, but this materially shrinks exposure and should be folded into your normal browser maintenance program ahead of the 365-day remediation deadline.
4. Monitor browser child-process anomalies — Use EDR detections for suspicious child processes spawned by Chrome, unusual PowerShell/cmd/bash launches, crash clusters, and extension-related persistence. This does not replace patching, but it gives you a chance to catch malicious-extension abuse while you remediate inside the 365-day window.

Run this on the target endpoint or via your software-distribution/EDR scripting channel. Invoke it with python3 check_chrome_cve_2026_11201.py on macOS/Linux or py check_chrome_cve_2026_11201.py on Windows; no admin rights are required for version-only checks, though broader path visibility helps.

#!/usr/bin/env python3
# check_chrome_cve_2026_11201.py
# Detects whether local Google Chrome version is vulnerable to CVE-2026-11201.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import subprocess
import sys

FIXED = (149, 0, 7827, 53)


def parse_version(text):
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def run_cmd(cmd):
    try:
        p = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, timeout=10)
        out = (p.stdout or '') + '\n' + (p.stderr or '')
        return out.strip()
    except Exception:
        return ''


def get_version_windows():
    candidates = [
        ["reg", "query", r"HKCU\Software\Google\Chrome\BLBeacon", "/v", "version"],
        ["reg", "query", r"HKLM\Software\Google\Chrome\BLBeacon", "/v", "version"],
        ["reg", "query", r"HKLM\Software\WOW6432Node\Google\Chrome\BLBeacon", "/v", "version"],
    ]
    for cmd in candidates:
        out = run_cmd(cmd)
        v = parse_version(out)
        if v:
            return v, 'registry'

    exe_candidates = [
        os.path.expandvars(r"%ProgramFiles%\Google\Chrome\Application\chrome.exe"),
        os.path.expandvars(r"%ProgramFiles(x86)%\Google\Chrome\Application\chrome.exe"),
        os.path.expandvars(r"%LocalAppData%\Google\Chrome\Application\chrome.exe"),
    ]
    for path in exe_candidates:
        if path and os.path.exists(path):
            out = run_cmd([path, "--version"])
            v = parse_version(out)
            if v:
                return v, path
    return None, ''


def get_version_macos():
    candidates = [
        "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome",
        os.path.expanduser("~/Applications/Google Chrome.app/Contents/MacOS/Google Chrome"),
    ]
    for path in candidates:
        if os.path.exists(path):
            out = run_cmd([path, "--version"])
            v = parse_version(out)
            if v:
                return v, path
    return None, ''


def get_version_linux():
    cmds = [
        ["google-chrome", "--version"],
        ["google-chrome-stable", "--version"],
        ["chromium-browser", "--version"],
        ["chromium", "--version"],
    ]
    for cmd in cmds:
        out = run_cmd(cmd)
        v = parse_version(out)
        if v:
            return v, ' '.join(cmd)
    return None, ''


def main():
    system = platform.system().lower()
    if 'windows' in system:
        version, source = get_version_windows()
    elif 'darwin' in system:
        version, source = get_version_macos()
    else:
        version, source = get_version_linux()

    if not version:
        print('UNKNOWN - Could not determine Google Chrome version on this host')
        sys.exit(2)

    version_str = '.'.join(str(x) for x in version)
    fixed_str = '.'.join(str(x) for x in FIXED)

    if version < FIXED:
        print(f'VULNERABLE - Detected Chrome {version_str} from {source}; fixed version is {fixed_str} or later')
        sys.exit(1)
    else:
        print(f'PATCHED - Detected Chrome {version_str} from {source}; fixed version threshold is {fixed_str}')
        sys.exit(0)


if __name__ == '__main__':
    main()

Sources

1. Chrome Releases - Stable Channel Update for Desktop
2. Chromium issue 505068950
3. GitHub Advisory Database - GHSA-9pgr-9977-jg98
4. CIRCL Vulnerability Lookup - CVE-2026-11201
5. CISA Known Exploited Vulnerabilities Catalog
6. Chromium Security - Memory safety
7. Chromium Security - Site Isolation
8. SynScan - CVE-2026-11201