Insufficient policy enforcement in DevTools in Google Chrome prior to 149

CVE-2026-11212 is an improper access-control flaw in Chrome DevTools policy enforcement. In Chrome versions before 149.0.7827.53 on Linux and before 149.0.7827.53/54 on Windows/macOS, an attacker can use a crafted malicious Chrome extension to leak cross-origin data after the user installs that extension. The affected population is broad in theory because Chrome is everywhere, but the vulnerable path is narrow in practice because the bug does not give an unauthenticated website direct reach into the browser.

Google's Medium 4.3 label is fair in lab conditions, but for enterprise patch triage it overstates urgency. The decisive friction is that the attacker must first convince the user to install a malicious extension, which is already a meaningful compromise step and one that well-run enterprise Chrome fleets often blunt with allowlists, blocklists, and forced-install policies. This is real, patchable, and worth rolling up in normal browser currency management, but it is not the thing that should jump ahead of remotely reachable server-side bugs or true browser drive-by RCEs.

Why this verdict

• Requires prior foothold in the browser trust boundary: the attacker must get a user to install a malicious extension before the CVE matters.
• Exposure is policy-dependent, not internet-wide: if you already restrict extension installs, the reachable population collapses hard.
• Impact is confidentiality-only and modest: vendor vector shows low confidentiality impact with no integrity or availability damage.
• No exploitation signal: not KEV-listed, no public PoC found, and the provided EPSS is extremely low.
• Modern enterprise tools should stop step 1: extension allowlists, blocklists, browser management, and user-install restrictions are exactly the right brakes here.

Why not higher?

This is not unauthenticated remote code execution, not a renderer escape, and not a no-click web attack. The full chain assumes user action plus extension installation plus useful session data in the browser, which is too much compounded friction to justify MEDIUM-or-higher patch urgency in a 10,000-host queue.

Why not lower?

I am not calling it IGNORE because Chrome is ubiquitous and a successful malicious extension can still harvest sensitive cross-origin data from real business sessions. If your fleet allows broad extension self-service, the reachable population is non-trivial enough that you still want this fixed as part of browser hygiene.

1. Block unapproved extensions — Set ExtensionInstallBlocklist to * and use ExtensionInstallAllowlist or ExtensionSettings for approved IDs. For a LOW verdict there is no mitigation SLA, so use this where governance is weak and fold it into backlog hardening rather than emergency change.
2. Inventory risky extension permissions — Hunt for extensions requesting debugger, broad host permissions, or unusual tab/network access. Prioritize privileged users and developer workstations; this is the fastest way to find the prerequisite that makes the CVE exploitable.
3. Restrict developer tooling where business-safe — Use DeveloperToolsAvailability, DeveloperToolsAvailabilityBlocklist, and related policies to narrow where DevTools can be used. This will not fully replace patching, but it reduces abuse paths in managed environments and can be rolled into normal policy maintenance.
4. Tighten extension exception workflow — Require approval for new extension IDs and review permission prompts during exceptions. The CVE's whole attack path depends on winning this trust decision first.

Run this on the target endpoint or via your software inventory/remote execution platform, not from a scanner box. Invoke it as python3 check_chrome_cve_2026_11212.py or pass an explicit binary path like python3 check_chrome_cve_2026_11212.py "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome"; it needs only normal user read/execute rights on the Chrome binary.

#!/usr/bin/env python3
# check_chrome_cve_2026_11212.py
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN

import os
import platform
import re
import shutil
import subprocess
import sys

FIXED = (149, 0, 7827, 53)

def parse_ver(s):
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', s)
    return tuple(int(x) for x in m.groups()) if m else None

def cmp_ver(a, b):
    return (a > b) - (a < b)

def candidate_paths():
    system = platform.system()
    paths = []

    if len(sys.argv) > 1:
        paths.append(sys.argv[1])

    if system == 'Windows':
        envs = [os.environ.get('ProgramFiles'), os.environ.get('ProgramFiles(x86)'), os.environ.get('LocalAppData')]
        suffixes = [
            r'Google\\Chrome\\Application\\chrome.exe',
            r'Chromium\\Application\\chrome.exe'
        ]
        for base in envs:
            if base:
                for suffix in suffixes:
                    paths.append(os.path.join(base, suffix))
    elif system == 'Darwin':
        paths.extend([
            '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
            os.path.expanduser('~/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'),
            '/Applications/Chromium.app/Contents/MacOS/Chromium'
        ])
        for name in ['Google Chrome', 'Chromium']:
            which = shutil.which(name)
            if which:
                paths.append(which)
    else:
        paths.extend([
            '/usr/bin/google-chrome',
            '/usr/bin/google-chrome-stable',
            '/usr/bin/chromium',
            '/usr/bin/chromium-browser',
            '/snap/bin/chromium'
        ])
        for name in ['google-chrome', 'google-chrome-stable', 'chromium', 'chromium-browser']:
            which = shutil.which(name)
            if which:
                paths.append(which)

    # de-dup while preserving order
    seen = set()
    out = []
    for p in paths:
        if p and p not in seen:
            seen.add(p)
            out.append(p)
    return out

def get_version(binary):
    try:
        proc = subprocess.run([binary, '--version'], capture_output=True, text=True, timeout=10)
        text = (proc.stdout or '') + ' ' + (proc.stderr or '')
        return parse_ver(text.strip())
    except Exception:
        return None

def main():
    found = []
    for p in candidate_paths():
        if os.path.exists(p):
            ver = get_version(p)
            found.append((p, ver))

    if not found:
        print('UNKNOWN - Chrome/Chromium binary not found')
        sys.exit(2)

    # Prefer Google Chrome if present; otherwise evaluate all discovered binaries.
    for p, ver in found:
        if ver is None:
            continue
        if cmp_ver(ver, FIXED) < 0:
            print(f'VULNERABLE - {p} version {ver[0]}.{ver[1]}.{ver[2]}.{ver[3]} is below 149.0.7827.53')
            sys.exit(1)

    for p, ver in found:
        if ver is not None:
            print(f'PATCHED - {p} version {ver[0]}.{ver[1]}.{ver[2]}.{ver[3]} is at or above 149.0.7827.53')
            sys.exit(0)

    print('UNKNOWN - Binary found but version could not be determined')
    sys.exit(2)

if __name__ == '__main__':
    main()

Sources

1. NVD CVE-2026-11212
2. Chrome stable channel update for desktop (2026-06-02)
3. Chrome early stable update for desktop (2026-05-29)
4. CISA Known Exploited Vulnerabilities Catalog
5. FIRST EPSS overview
6. Chrome extension permission warning guidelines
7. Chrome debugger API reference
8. Chrome Enterprise extension allowlist policy