Inappropriate implementation in GPU in Google Chrome on Mac prior to 149

CVE-2026-11203 is a GPU-path policy bypass / cross-origin data leak in Google Chrome on macOS. Google’s CNA record says versions before 149.0.7827.53 are affected; the June 2, 2026 stable release moved Chrome 149 to 149.0.7827.53/54 on Windows/Mac. The attack is delivered through a crafted HTML page and the stated impact is cross-origin data disclosure, not code execution or sandbox escape.

The vendor’s MEDIUM 6.5 is directionally right, but still a little generous for enterprise prioritization. The attack requires user interaction, is Mac-only, yields confidentiality impact only, has no KEV listing, very low EPSS, and there is no public exploitation signal in the sources reviewed. Browser ubiquity keeps it from dropping into noise, but the real-world friction clearly pushes it below anything you would treat like a browser RCE.

Why this verdict

• Mac-only scope cuts the population: this is not a full Chrome desktop problem; Windows and Linux fleets are out of scope for this CVE, which materially reduces reachable enterprise exposure.
• User interaction is mandatory: the attacker needs the victim to render a crafted page, which implies phishing, malicious ad traffic, or compromised content delivery rather than direct unauthenticated reach.
• Impact is confidentiality-only: the published effect is cross-origin data leakage, not arbitrary code execution, sandbox escape, persistence, or host compromise.
• No live-fire pressure: no KEV entry, no public exploitation signal in the reviewed sources, and EPSS is extremely low, so there is no evidence this is becoming a broad operational threat right now.
• Chrome already has defense layers: Site Isolation and related cross-site data delivery protections on desktop Chrome reduce the chance that a same-origin bypass becomes a broad unrestricted data vacuum; that does not kill the bug, but it limits worst-case assumptions.

Why not higher?

To score this as HIGH, I would want either active exploitation, a public reliable PoC, or an impact profile that includes code execution / sandbox escape / account compromise at scale. We do not have that here. The chain is narrowed by platform, by required user action, and by the fact that the payoff is data disclosure inside browser trust boundaries rather than device takeover.

Why not lower?

It is still a remote browser bug against a massively deployed client, and the victim only has to browse to hostile content. For the right target, a same-origin bypass can expose sensitive SaaS or intranet session data, which is too consequential to dismiss as backlog lint. MEDIUM is the right landing zone: real, patch-worthy, but not an emergency.

1. Force Chrome auto-update and relaunch — Use your browser management stack to verify that managed Macs are taking current stable Chrome and actually relaunching into the new build. For a MEDIUM verdict there is no mitigation SLA, so use normal change control, but complete the actual browser update within the 365-day remediation window.
2. Disable hardware acceleration on exception Macs — If a subset of Macs cannot patch promptly, temporarily set HardwareAccelerationModeEnabled=false through Chrome Enterprise policy to reduce exposure to the affected GPU path. This is a containment move for exceptions only; there is no mitigation SLA for MEDIUM, so use it where patch lag is real and performance trade-offs are acceptable.
3. Target high-risk browsing groups first — Prioritize security admins, executives, finance, deal teams, and users with broad SaaS access because the practical impact is session-bound data leakage. Even without a formal mitigation deadline, use this focus to shrink business blast radius while routine browser updating completes inside the 365-day remediation window.
4. Keep web filtering and phishing controls tuned — Because exploitation starts with a crafted page, secure web gateways, DNS filtering, and browser isolation controls can reduce how often users ever reach weaponized content. For this MEDIUM item these are supporting measures, not a substitute for patching.

Run this on the target Mac endpoint or through your Mac management/remote shell tooling. Invoke it with bash check_cve_2026_11203_chrome_mac.sh; it needs no root privileges and returns exit code 0 for PATCHED, 1 for VULNERABLE, and 2 for UNKNOWN.

#!/bin/bash
# check_cve_2026_11203_chrome_mac.sh
# Verifies whether Google Chrome on macOS is vulnerable to CVE-2026-11203
# Affected: Google Chrome on macOS before 149.0.7827.53
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

FIXED_VERSION="149.0.7827.53"
CHROME_APP="/Applications/Google Chrome.app"
PLIST="$CHROME_APP/Contents/Info.plist"

verlte() {
  [ "$1" = "$2" ] && return 0
  local first
  first=$(printf '%s\n%s\n' "$1" "$2" | sort -V | head -n1)
  [ "$first" = "$1" ]
}

if [ "$(uname -s)" != "Darwin" ]; then
  echo "UNKNOWN: This check is intended for macOS only."
  exit 2
fi

if [ ! -d "$CHROME_APP" ]; then
  echo "UNKNOWN: Google Chrome.app not found in /Applications."
  exit 2
fi

if [ ! -f "$PLIST" ]; then
  echo "UNKNOWN: Chrome Info.plist not found."
  exit 2
fi

VERSION=$(/usr/bin/defaults read "$PLIST" CFBundleShortVersionString 2>/dev/null || true)

if [ -z "$VERSION" ]; then
  VERSION=$(/usr/bin/defaults read "$PLIST" KSVersion 2>/dev/null || true)
fi

if [ -z "$VERSION" ]; then
  echo "UNKNOWN: Unable to determine Chrome version."
  exit 2
fi

if verlte "$VERSION" "$FIXED_VERSION" && [ "$VERSION" != "$FIXED_VERSION" ]; then
  echo "VULNERABLE: Google Chrome version $VERSION is older than fixed version $FIXED_VERSION."
  exit 1
fi

if [ "$VERSION" = "$FIXED_VERSION" ] || ! verlte "$VERSION" "$FIXED_VERSION"; then
  echo "PATCHED: Google Chrome version $VERSION is at or above fixed version $FIXED_VERSION."
  exit 0
fi

echo "UNKNOWN: Unable to compare version $VERSION to fixed version $FIXED_VERSION."
exit 2

Sources

1. Chrome Releases: Stable Channel Update for Desktop (Chrome 149)
2. GitHub Advisory Database: GHSA-793m-2h6c-59w8
3. CIRCL Vulnerability Lookup: CVE-2026-11203
4. CISA Known Exploited Vulnerabilities Catalog
5. FIRST EPSS data and report
6. Chromium Site Isolation overview
7. Chrome Enterprise policy: HardwareAccelerationModeEnabled
8. Chrome for Testing availability (149.0.7827.53 assets)