Inappropriate implementation in Enterprise in Google Chrome prior to 149

CVE-2026-11229 is an *Enterprise* component flaw in Google Chrome that affects desktop builds prior to 149.0.7827.53 on Linux and prior to 149.0.7827.53/54 on Windows and macOS. The vendor description says a *local attacker* can achieve privilege escalation, but only with *physical access to the device*; that is the whole story here. This is not a webpage bug, not a drive-by, and not something an internet scanner is going to find or weaponize at scale.

The vendor's MEDIUM 6.1 baseline overstates operational urgency for most enterprises. Privilege escalation is serious in a lab, but the attack path already assumes the attacker is at the device, which means this is either a stolen/unlocked endpoint, insider misuse, kiosk abuse, or post-initial-access cleanup. That prerequisite collapses the exposed population so hard that the real-world priority lands in LOW, not because the bug is harmless, but because the reachable blast radius is narrow.

Why this verdict

• Major downgrade for attacker position: vendor starts at 6.1, but AV:P means the attacker must be physically at the device, which implies a stolen, unattended, kiosk, insider, or already-compromised endpoint scenario rather than internet-reachable abuse.
• Further downgrade for exposure population: Chrome is ubiquitous, but this specific step is not externally exposed. A remote adversary cannot spray this across 10,000 hosts the way they can with browser RCE, gateway bugs, or VPN flaws.
• Further downgrade for operational evidence: no KEV listing, no active-exploitation reporting, no public PoC, and a near-zero EPSS all argue against emergency handling.

Why not higher?

If this were unauthenticated remote, sandbox-escape-adjacent, or already being used in the wild, the score would jump fast because Chrome is everywhere. But the physical/local prerequisite is a hard gate, and public sources do not show an exploit ecosystem forming around it.

Why not lower?

It still produces privilege escalation on a real enterprise endpoint, which matters for shared workstations, kiosks, and stolen-but-unlocked devices. Also, Chrome is massively deployed, so even a narrow local bug deserves routine correction rather than a paperwork-only dismissal.

1. Enforce aggressive screen lock and full-disk encryption — Make physical possession insufficient for exploitation. Auto-lock, pre-boot authentication, and disk encryption are the best compensating controls because they directly attack the main prerequisite; for a LOW verdict there is no mitigation SLA, so treat this as backlog hygiene and verify policy coverage in the normal endpoint hardening cycle.
2. Harden kiosk and shared-device profiles — If you run Chrome in kiosk, lab, or front-desk scenarios, reduce the chance of local interaction abuse with restricted shells, session timeouts, and peripheral controls. These are the few environments where this CVE is more than theoretical; again, no mitigation SLA applies for LOW, so fold this into standard workstation baseline maintenance.
3. Use asset inventory to find pre-149 builds — Pull Chrome version data from EDR, MDM, or software inventory and identify hosts below the fixed version line. This is the practical control because network scanners will not meaningfully surface a local/physical-only browser flaw; for LOW, handle in routine backlog hygiene.

Run this on the target endpoint or through your EDR/remote execution tool. Invoke with python3 check_chrome_cve_2026_11229.py on macOS/Linux or py check_chrome_cve_2026_11229.py on Windows; no administrator rights are required, but the script needs permission to execute Chrome binaries or read their standard install paths.

#!/usr/bin/env python3
# check_chrome_cve_2026_11229.py
# Detects whether Google Chrome is older than 149.0.7827.53.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import shutil
import subprocess
import sys
from pathlib import Path

FIXED = (149, 0, 7827, 53)


def parse_version(text):
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def compare_versions(a, b):
    return (a > b) - (a < b)


def run_version(cmd):
    try:
        p = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True, timeout=10)
        out = (p.stdout or '').strip()
        return parse_version(out), out
    except Exception:
        return None, ''


def candidate_commands():
    system = platform.system()
    cmds = []

    if system == 'Windows':
        env = os.environ
        local = env.get('LOCALAPPDATA', '')
        pf = env.get('PROGRAMFILES', '')
        pfx86 = env.get('PROGRAMFILES(X86)', '')
        candidates = [
            Path(local) / 'Google/Chrome/Application/chrome.exe',
            Path(pf) / 'Google/Chrome/Application/chrome.exe',
            Path(pfx86) / 'Google/Chrome/Application/chrome.exe',
        ]
        for p in candidates:
            if p and p.exists():
                cmds.append([str(p), '--version'])
        where = shutil.which('chrome') or shutil.which('chrome.exe')
        if where:
            cmds.append([where, '--version'])

    elif system == 'Darwin':
        candidates = [
            '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
            str(Path.home() / 'Applications/Google Chrome.app/Contents/MacOS/Google Chrome'),
        ]
        for p in candidates:
            if Path(p).exists():
                cmds.append([p, '--version'])
        for name in ['google-chrome', 'chrome', 'chromium', 'chromium-browser']:
            where = shutil.which(name)
            if where:
                cmds.append([where, '--version'])

    else:
        for name in ['google-chrome', 'google-chrome-stable', 'chrome', 'chromium', 'chromium-browser']:
            where = shutil.which(name)
            if where:
                cmds.append([where, '--version'])
        extra = [
            '/opt/google/chrome/chrome',
            '/usr/bin/google-chrome',
            '/usr/bin/google-chrome-stable',
        ]
        for p in extra:
            if Path(p).exists():
                cmds.append([p, '--version'])

    # de-dup while preserving order
    seen = set()
    uniq = []
    for c in cmds:
        key = tuple(c)
        if key not in seen:
            seen.add(key)
            uniq.append(c)
    return uniq


def main():
    cmds = candidate_commands()
    if not cmds:
        print('UNKNOWN - Google Chrome executable not found in common locations')
        sys.exit(2)

    for cmd in cmds:
        ver, raw = run_version(cmd)
        if ver is None:
            continue

        if compare_versions(ver, FIXED) < 0:
            print(f'VULNERABLE - detected version {".".join(map(str, ver))} via {cmd[0]}')
            sys.exit(1)
        else:
            print(f'PATCHED - detected version {".".join(map(str, ver))} via {cmd[0]}')
            sys.exit(0)

    print('UNKNOWN - executable found but version could not be parsed')
    sys.exit(2)


if __name__ == '__main__':
    main()

Sources

1. Google Chrome Releases - Early Stable Update for Desktop
2. Canadian Centre for Cyber Security advisory AV26-544
3. CISA Known Exploited Vulnerabilities Catalog
4. FIRST EPSS overview
5. SecurityWeek - Chrome 149 Patches 429 Vulnerabilities
6. VulDB entry for CVE-2026-11229
7. CVE.org record for CVE-2026-11229
8. NVD record for CVE-2026-11229