Incorrect security UI in Tab Strip in Google Chrome prior to 149

CVE-2026-11222 is a security UI spoofing bug in Chrome's Tab Strip that affects Chrome before 149.0.7827.53 on Linux and before 149.0.7827.53/.54 on Windows and macOS. A remote attacker can host a crafted page that makes the browser present misleading domain information in the tab UI, creating a domain spoofing condition rather than code execution, sandbox escape, or data theft by itself.

Google's MEDIUM 6.5 label is defensible in pure CVSS terms because the flaw is remote and can mislead users, but it overstates the operational urgency for enterprise patch triage. The real-world attack still needs a full phishing chain: lure, user attention failure, credential capture or approval, and usually weak auth downstream. The bug improves phish credibility; it does not directly compromise the host.

Why this verdict

• User interaction is mandatory: the attacker must first deliver a lure and get a user onto attacker-controlled content; that is classic phishing-chain friction, not wormable browser exploitation.
• The implied attacker position is pre-compromise but low-leverage: unauthenticated remote is broad, but the bug's value only appears after the victim makes a trust decision. That sharply reduces real attacker ROI compared with Chrome RCEs.
• The reachable population is broad, but the payoff is narrow: Chrome is everywhere, yet this CVE only buys visual deception in one app. It does not yield code execution, local privilege, or cross-host blast radius.
• Modern controls should stop downstream abuse: safe browsing, email security, password-manager origin matching, IdP conditional access, and especially FIDO2/WebAuthn all cut off the actual compromise step.
• Threat intel is cold: EPSS is extremely low, there is no KEV listing, and I found no authoritative exploitation signal. Starting from Google's 6.5 baseline, those are explicit downward adjustments.

Why not higher?

If this were a Chrome memory-corruption bug with no-click or visit-only exploitation, it would land much higher because Chrome is universal and attacker reach would be enormous. Here, the CVE only improves the believability of a phish; the attacker still has to win the human and identity-control layers.

Why not lower?

I am not calling this IGNORE because browser UI spoofing can still raise phish conversion rates in real enterprises, especially where passwords or push MFA remain in use. Chrome is widely deployed, so even a low-grade credibility booster can matter at scale if your identity stack is weak.

1. Enforce phishing-resistant auth — Prioritize FIDO2/WebAuthn, passkeys, or other origin-bound methods so a spoofed tab label cannot convert directly into credential reuse. For a LOW verdict there is no formal mitigation SLA, but this should remain a standing control objective rather than a CVE-specific emergency action.
2. Inventory Chrome laggards — Use endpoint management to find systems still below 149.0.7827.53/54 and verify auto-update health. For a LOW verdict there is no formal mitigation SLA; handle this as routine fleet hygiene in the next browser maintenance cycle.
3. Tighten browser-to-IdP trust cues — Lean on password managers, managed bookmarks, SSO shortcuts, IdP branding, and conditional access so users arrive through known-good flows instead of ad hoc links. For a LOW verdict there is no formal mitigation SLA, but these controls reduce the real payoff of UI-spoofing bugs across the board.
4. Hunt for phish outcomes, not CVE triggers — Monitor for reverse-proxy phish, suspicious OAuth grants, MFA fatigue, and anomalous sign-ins because those are the practical impacts this CVE would feed into. For a LOW verdict there is no formal mitigation SLA; integrate the hunts into normal identity-defense operations.

Run this on the target endpoint or through your software-distribution/EDR script runner. Invoke with python3 check_chrome_cve_2026_11222.py on macOS/Linux or py -3 check_chrome_cve_2026_11222.py on Windows; no admin rights are normally required, though some locked-down registry or app paths may need elevated read access.

#!/usr/bin/env python3
# check_chrome_cve_2026_11222.py
# Detect whether Google Chrome is below the fixed version for CVE-2026-11222.
# Outputs exactly one of: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 1=vulnerable, 0=patched, 2=unknown

import os
import platform
import re
import subprocess
import sys

FIXED_WIN_MAC = (149, 0, 7827, 53)
FIXED_LINUX = (149, 0, 7827, 53)


def parse_version(s):
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', s or '')
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def version_lt(a, b):
    return a < b


def run_cmd(cmd):
    try:
        p = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, timeout=10)
        if p.returncode == 0:
            return p.stdout.strip() or p.stderr.strip()
    except Exception:
        pass
    return None


def get_windows_version():
    try:
        import winreg
    except ImportError:
        return None

    keys = [
        (winreg.HKEY_CURRENT_USER, r"Software\Google\Chrome\BLBeacon", "version"),
        (winreg.HKEY_LOCAL_MACHINE, r"Software\Google\Chrome\BLBeacon", "version"),
        (winreg.HKEY_LOCAL_MACHINE, r"Software\WOW6432Node\Google\Chrome\BLBeacon", "version"),
    ]

    for hive, path, value_name in keys:
        try:
            with winreg.OpenKey(hive, path) as key:
                val, _ = winreg.QueryValueEx(key, value_name)
                v = parse_version(str(val))
                if v:
                    return v
        except OSError:
            continue

    candidates = [
        os.path.expandvars(r"%ProgramFiles%\Google\Chrome\Application\chrome.exe"),
        os.path.expandvars(r"%ProgramFiles(x86)%\Google\Chrome\Application\chrome.exe"),
        os.path.expandvars(r"%LocalAppData%\Google\Chrome\Application\chrome.exe"),
    ]
    for exe in candidates:
        if exe and os.path.exists(exe):
            out = run_cmd([exe, "--version"])
            v = parse_version(out or "")
            if v:
                return v
    return None


def get_macos_version():
    app = "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome"
    if os.path.exists(app):
        out = run_cmd([app, "--version"])
        v = parse_version(out or "")
        if v:
            return v
    return None


def get_linux_version():
    candidates = [
        ["google-chrome", "--version"],
        ["google-chrome-stable", "--version"],
        ["chromium-browser", "--version"],
        ["chromium", "--version"],
        ["/opt/google/chrome/chrome", "--version"],
        ["/usr/bin/google-chrome", "--version"],
        ["/usr/bin/google-chrome-stable", "--version"],
    ]
    for cmd in candidates:
        out = run_cmd(cmd)
        v = parse_version(out or "")
        if v:
            return v
    return None


def main():
    system = platform.system().lower()
    if system == "windows":
        v = get_windows_version()
        fixed = FIXED_WIN_MAC
    elif system == "darwin":
        v = get_macos_version()
        fixed = FIXED_WIN_MAC
    elif system == "linux":
        v = get_linux_version()
        fixed = FIXED_LINUX
    else:
        print("UNKNOWN")
        return 2

    if not v:
        print("UNKNOWN")
        return 2

    if version_lt(v, fixed):
        print("VULNERABLE")
        return 1

    print("PATCHED")
    return 0


if __name__ == "__main__":
    sys.exit(main())

Sources

1. Google Chrome Releases - Early Stable Update for Desktop (149.0.7827.53/.54)
2. Google Chrome Releases - Chrome Beta for Desktop Update (149.0.7827.53)
3. Canadian Centre for Cyber Security - Google Chrome security advisory AV26-544
4. Chrome Enterprise Help - Chrome browser release channels
5. Google Chrome Help - Update Google Chrome
6. FIRST - EPSS data and statistics
7. CISA - Known Exploited Vulnerabilities Catalog
8. Quanteta CVE Tracker entry set including CVE-2026-11222