Incorrect security UI in Tab Hover Cards in Google Chrome prior to 149

CVE-2026-11227 is a Chrome desktop UI spoofing flaw in Tab Hover Cards: before 149.0.7827.53 on Linux and 149.0.7827.53/54 on Windows/macOS, a remote attacker could use a crafted domain name so the hover-card security UI misrepresents what site the user is looking at. Affected population is broad in product terms—Chrome desktop is everywhere—but the vulnerable surface is narrow: it is a secondary trust signal shown when a user hovers over a tab, not a direct memory-corruption or sandbox-escape primitive.

The vendor-side 6.5 / MEDIUM overstates enterprise urgency. In practice this is a user-deception aid that still needs a phishing setup, a victim to browse or click, and a victim to rely on the hover card instead of the omnibox, enterprise filtering, identity prompts, or page content. Chromium itself labeled it Low, and that better matches the real-world blast radius.

Why this verdict

• UI:R is the whole story — exploitation requires a victim to land on attacker content and trust the hover-card display, which is immediate downward pressure from the 6.5 baseline.
• Secondary UI, not primary origin enforcement — this appears to mislead a hover card, not the browser's same-origin model, process sandbox, or memory safety boundaries.
• Blast radius is narrow — even a successful attack usually helps steal one user's trust or credentials; it does not turn into host takeover or tenant-wide compromise on its own.
• Modern controls cut payoff — phishing-resistant MFA, password managers, DNS filtering, secure email gateways, and SSO origin checks all sit in the attack path and frequently break the chain.
• No KEV / no public exploit evidence / very low EPSS — current threat intelligence does not support emergency handling.

Why not higher?

If this were an address-bar spoof, cert-indicator bypass, origin bypass, or a flaw already used in credential-harvesting campaigns, it would climb. But the evidence here points to a narrower deception bug in tab hover cards, with no public exploitation and no direct technical compromise primitive.

Why not lower?

It is still a real remotely triggerable browser flaw in a massively deployed product, and phishing-assist bugs do matter at enterprise scale. A large enough user base means even low-conviction UI spoofing can create avoidable identity incidents, so this is not IGNORE.

1. Force browser auto-update — Use Chrome enterprise policy or your endpoint management stack to keep desktop Chrome on the stable channel and prevent long-lived lagging versions. For a LOW verdict there is no mitigation SLA and no remediation SLA beyond backlog hygiene, so do this in the normal browser maintenance flow rather than as an emergency change.
2. Harden phishing-resistant sign-in — Push FIDO2/WebAuthn, conditional access, and password-manager-only credential entry for high-value apps. This directly reduces the only realistic payoff path for this bug; for LOW, fold it into the normal hardening roadmap rather than a rush action.
3. Block lookalike domains upstream — Use secure email, DNS filtering, and browser isolation to stop newly registered or suspicious lookalike domains before users ever see the spoofed UI. Again, LOW means no special mitigation deadline; enforce through standard control tuning.
4. Report version drift — Audit for Chrome versions below 149.0.7827.53 and push laggards into your existing desktop patch queue. Treat exceptions as patch hygiene debt, not a Sev1 incident.

Run this on the target endpoint or through your fleet agent on Windows, macOS, or Linux. Invoke it with python3 check_chrome_cve_2026_11227.py; it needs only normal user rights and reports VULNERABLE, PATCHED, or UNKNOWN by comparing the local Chrome version to 149.0.7827.53.

#!/usr/bin/env python3
# CVE-2026-11227 Chrome version check
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import subprocess
import sys
from shutil import which

FIXED = (149, 0, 7827, 53)


def parse_version(text):
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text or '')
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def version_str(v):
    return '.'.join(str(x) for x in v)


def run_version(cmd):
    try:
        p = subprocess.run([cmd, '--version'], capture_output=True, text=True, timeout=10)
        out = (p.stdout or '') + ' ' + (p.stderr or '')
        v = parse_version(out)
        if v:
            return cmd, v, out.strip()
    except Exception:
        pass
    return None


def candidate_paths():
    system = platform.system().lower()
    cands = []

    if system == 'windows':
        local = os.environ.get('LOCALAPPDATA', '')
        programfiles = os.environ.get('PROGRAMFILES', '')
        programfilesx86 = os.environ.get('PROGRAMFILES(X86)', '')
        cands.extend([
            os.path.join(local, 'Google', 'Chrome', 'Application', 'chrome.exe'),
            os.path.join(programfiles, 'Google', 'Chrome', 'Application', 'chrome.exe'),
            os.path.join(programfilesx86, 'Google', 'Chrome', 'Application', 'chrome.exe'),
        ])
    elif system == 'darwin':
        cands.extend([
            '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
            os.path.expanduser('~/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'),
        ])
    else:
        for name in ['google-chrome', 'google-chrome-stable', 'chromium', 'chromium-browser', 'chrome']:
            p = which(name)
            if p:
                cands.append(p)
        cands.extend([
            '/usr/bin/google-chrome',
            '/usr/bin/google-chrome-stable',
            '/usr/bin/chromium',
            '/usr/bin/chromium-browser',
            '/opt/google/chrome/chrome',
        ])

    # Deduplicate while preserving order
    seen = set()
    ordered = []
    for c in cands:
        if c and c not in seen:
            seen.add(c)
            ordered.append(c)
    return ordered


def main():
    found = []
    for path in candidate_paths():
        if os.path.exists(path) or which(path):
            res = run_version(path)
            if res:
                found.append(res)

    if not found:
        print('UNKNOWN - Google Chrome executable not found or version could not be parsed')
        sys.exit(2)

    # Prefer the highest discovered version if multiple installs exist
    found.sort(key=lambda x: x[1], reverse=True)
    cmd, ver, raw = found[0]

    if ver < FIXED:
        print(f'VULNERABLE - detected {version_str(ver)} at {cmd}; fixed version is {version_str(FIXED)} or later')
        sys.exit(1)
    else:
        print(f'PATCHED - detected {version_str(ver)} at {cmd}; fixed threshold is {version_str(FIXED)}')
        sys.exit(0)


if __name__ == '__main__':
    main()

Sources

1. NVD entry for CVE-2026-11227
2. Chrome Releases stable desktop update for June 2, 2026
3. Chromium issue 448421954
4. Chrome for Testing availability
5. Canadian Centre for Cyber Security advisory AV26-544
6. FIRST EPSS overview
7. FIRST EPSS model documentation
8. CISA Known Exploited Vulnerabilities Catalog