Insufficient validation of untrusted input in PointerLock in Google Chrome prior to 149

CVE-2026-11221 is a PointerLock input-validation flaw in Google Chrome affecting desktop builds before 149.0.7827.53 on Linux and before 149.0.7827.53/.54 on Windows and macOS. The bug enables *UI spoofing* through a crafted HTML page, but the important qualifier is in the description: the attacker must have already compromised the renderer process first. That makes this a second-stage browser abuse primitive, not a standalone drive-by compromise.

The vendor-style 4.3 MEDIUM label is too generous for real-world enterprise prioritization because the CVSS framing hides the biggest friction point: this CVE does not get an attacker into Chrome. It only helps *after* some other bug or trust break has already landed code or control inside the renderer, and even then the outcome is UI spoofing rather than sandbox escape or native code execution. For a 10,000-host fleet, that pushes this down into backlog territory unless it is paired with another actively exploited Chrome renderer bug.

Why this verdict

• Major downgrade for attacker position: the description itself says the attacker must have *already compromised the renderer process*, which implies a prior exploit stage or malicious extension path.
• Population is narrower than CVSS suggests: every vulnerable Chrome install is not directly reachable by this CVE; only systems where an attacker can already execute within a renderer can use it.
• Modern controls should stop the earlier stage: Chrome sandboxing, Safe Browsing, extension controls, EDR, and browser isolation are all more relevant than this bug's own mechanics.
• Blast radius is limited: the stated effect is UI spoofing, not arbitrary code execution, sandbox escape, or credential dump by technical force alone.
• Threat intel is cold: no KEV listing, no public exploitation evidence found, and an EPSS of 0.00034 does not argue for front-of-queue treatment.

Why not higher?

It is not higher because the bug is not an initial foothold. Requiring internal browser compromise first is compounding friction: it assumes the attacker has already beaten stronger controls with another exploit, and this CVE only improves deception inside that constrained session. If active exploit chains pairing this with a renderer RCE emerge, reassess immediately.

Why not lower?

It is not IGNORE because Chrome is ubiquitous and UI spoofing inside a live browser session can still enable phishing, fake permission prompts, or consent capture. On high-risk user groups and unmanaged browsing paths, second-stage browser deception bugs still have operational value to attackers.

1. Enforce rapid Chrome auto-update — Use enterprise browser management to pin clients to current stable and verify version drift. For a LOW verdict there is no hard mitigation SLA, but this is still good hygiene to close a second-stage browser primitive without waiting for user-driven updates.
2. Apply remote browser isolation for risky traffic — Route unmanaged web categories, phishing-prone users, and high-risk destinations through RBI or equivalent isolation. That reduces the value of both the prerequisite renderer exploit and any follow-on PointerLock spoofing; for LOW, treat this as risk-reduction backlog work rather than emergency change.
3. Restrict extension installation — Use allowlists and signed enterprise distribution only. Several Chrome bug chains become practical through malicious extensions, so reducing extension sprawl cuts off a common path to the renderer-compromise prerequisite.
4. Monitor for abnormal browser-child-process activity — Tune EDR and browser telemetry for suspicious renderer crashes, repeated restarts, unusual permission prompts, and anomalous fullscreen/pointer-lock behavior. The control is aimed at the exploit chain around this bug, not the UI spoofing primitive itself.

Run this on the target endpoint or through your fleet management agent. Invoke it as python3 chrome_cve_2026_11221_check.py on macOS/Linux or py chrome_cve_2026_11221_check.py on Windows; no admin rights are required, but the script needs permission to read common Chrome install paths and execute the local Chrome binary for --version.

#!/usr/bin/env python3
# CVE-2026-11221 Chrome version check
# Outputs: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import shutil
import subprocess
import sys
from pathlib import Path

TARGET = (149, 0, 7827, 53)


def parse_version(text):
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def cmp_ver(a, b):
    return (a > b) - (a < b)


def candidates():
    system = platform.system()
    paths = []
    if system == 'Windows':
        local = os.environ.get('LOCALAPPDATA', '')
        program_files = os.environ.get('ProgramFiles', '')
        program_files_x86 = os.environ.get('ProgramFiles(x86)', '')
        paths += [
            Path(program_files) / 'Google/Chrome/Application/chrome.exe',
            Path(program_files_x86) / 'Google/Chrome/Application/chrome.exe',
            Path(local) / 'Google/Chrome/Application/chrome.exe',
        ]
    elif system == 'Darwin':
        paths += [
            Path('/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'),
            Path.home() / 'Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
        ]
    else:
        for name in ['google-chrome', 'google-chrome-stable', 'chromium', 'chromium-browser']:
            p = shutil.which(name)
            if p:
                paths.append(Path(p))
        paths += [
            Path('/opt/google/chrome/chrome'),
            Path('/usr/bin/google-chrome'),
            Path('/usr/bin/google-chrome-stable'),
        ]
    seen = []
    for p in paths:
        if p and p not in seen:
            seen.append(p)
    return seen


def get_version(binary):
    try:
        cp = subprocess.run([str(binary), '--version'], capture_output=True, text=True, timeout=8)
        out = (cp.stdout or '') + ' ' + (cp.stderr or '')
        ver = parse_version(out)
        if ver:
            return ver, out.strip()
    except Exception:
        pass
    return None, ''


def main():
    found = []
    for path in candidates():
        if path.exists() or shutil.which(str(path)):
            ver, raw = get_version(path)
            if ver:
                found.append((str(path), ver, raw))

    if not found:
        print('UNKNOWN: Google Chrome binary not found in common locations')
        sys.exit(2)

    # Prefer highest discovered version
    found.sort(key=lambda x: x[1], reverse=True)
    path, ver, raw = found[0]

    # Chrome desktop fixed baseline for this CVE is 149.0.7827.53+
    if cmp_ver(ver, TARGET) < 0:
        print(f'VULNERABLE: found {ver[0]}.{ver[1]}.{ver[2]}.{ver[3]} at {path}')
        sys.exit(1)
    else:
        print(f'PATCHED: found {ver[0]}.{ver[1]}.{ver[2]}.{ver[3]} at {path}')
        sys.exit(0)


if __name__ == '__main__':
    main()

Sources

1. Google Chrome Releases - Early Stable Update for Desktop (149.0.7827.53/.54)
2. Google Chrome Releases - Stable Channel Update for Desktop (June 2026 advisory)
3. CISA Known Exploited Vulnerabilities Catalog
4. FIRST EPSS API documentation
5. FIRST EPSS overview
6. Chromium issue 475235864 - Pointer Lock origin attribution / UI spoofing discussion
7. Canadian Centre for Cyber Security advisory AV26-544
8. SecurityWeek coverage of Chrome 149 patch wave