Inappropriate implementation in Safe Browsing in Google Chrome on Mac prior to 149

CVE-2026-11231 is a macOS-only Chrome client bug in Safe Browsing. Affected systems are Google Chrome on Mac before 149.0.7827.53; Google’s June 2, 2026 stable release moved macOS to 149.0.7827.53/54, and the CVE was then published in external feeds on June 4-5, 2026. The described outcome is arbitrary code execution, but the trigger is not a raw network service hit — the attacker needs the victim to handle a malicious file through Chrome’s vulnerable path.

The vendor’s HIGH 8.1 CVSS is directionally understandable because code execution in a browser is never trivial, but it overshoots the operational risk for enterprise patch triage. The big downgrade drivers are user interaction, malicious-file delivery, macOS-only scope, client-side non-routable exposure, no KEV listing, no public exploit, and a near-zero EPSS. Chrome’s own release note even tags the underlying Chromium bug as Low severity, which is a strong hint that the CVSS math is describing impact in a vacuum rather than reachability in the real world.

Why this verdict

• Down from 8.1 because the attacker does not hit a routable service — this is a browser client bug, so there is no Shodan-scale external exposure population to treat as edge risk
• Down again because it requires user interaction with a malicious file — UI:R is not a footnote here; it means the exploit chain depends on delivery success through mail/web controls and user behavior
• Down again because it is macOS-only — in most enterprise fleets that is a minority slice, so the reachable population is much smaller than 'all Chrome users'
• Down again because there is no KEV listing, no public PoC, and extremely low EPSS — threat evidence does not support emergency treatment
• Not lower because successful exploitation still lands arbitrary code execution on an endpoint — if it hits a privileged or high-value user, the follow-on damage can still be expensive

Why not higher?

A higher rating would require at least one strong amplifier that is missing here: active exploitation, a public reliable PoC, no-user-interaction reachability, or broad cross-platform exposure. Instead, the chain compounds friction at every step: Mac-only, malicious file, user action, then post-execution controls on the endpoint.

Why not lower?

It is still a bona fide code-execution bug in a widely deployed browser, not a cosmetic policy bypass. Even with a narrow trigger, one phished executive MacBook is enough to make this a real incident, so dropping it to LOW or IGNORE would understate the endpoint impact.

1. Enforce rapid Chrome auto-update on managed Macs — Make sure enterprise management is not deferring Chrome stable updates on macOS and verify that devices are allowed to move to 149.0.7827.53+. For a MEDIUM noisgate verdict there is no mitigation SLA — go straight to the 365-day remediation window, but browsers should still ride the normal accelerated update channel because the fix is already in stable.
2. Block risky file delivery patterns — Tighten mail and web controls for suspicious archives, disk images, and low-reputation downloads that target Mac users. This is the highest-value choke point because the exploit needs a malicious file first; with a MEDIUM verdict there is no separate mitigation deadline, so use this as immediate risk reduction while you complete patching inside the remediation window.
3. Harden macOS endpoint response to browser-spawned payloads — Tune EDR to alert on Chrome spawning unusual child processes, AppleScript execution, LaunchAgent persistence, and credential-store access. That contains the real damage path after exploitation and is especially useful where browser version drift exists.
4. Prioritize high-value Mac cohorts — Focus version verification and update enforcement on admins, developers, finance, and executives using managed Macs. The CVE is not broad enough for a fleet panic, but it is absolutely worth closing first on users whose browser sessions carry privileged access.

Run this on the target Mac endpoint or through your Mac management agent. Invoke it as bash check_chrome_cve_2026_11231.sh "/Applications/Google Chrome.app"; it needs only normal user rights to read the app bundle version and prints VULNERABLE, PATCHED, or UNKNOWN with an exit code.

#!/bin/bash
# check_chrome_cve_2026_11231.sh
# Determine whether Google Chrome on macOS is vulnerable to CVE-2026-11231
# Affected: Google Chrome on Mac prior to 149.0.7827.53
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

APP_PATH="${1:-/Applications/Google Chrome.app}"
REQUIRED_VERSION="149.0.7827.53"

if [[ "$(uname -s)" != "Darwin" ]]; then
  echo "UNKNOWN: This script is for macOS targets only"
  exit 2
fi

if [[ ! -d "$APP_PATH" ]]; then
  echo "UNKNOWN: Chrome app not found at $APP_PATH"
  exit 2
fi

PLIST="$APP_PATH/Contents/Info.plist"
if [[ ! -f "$PLIST" ]]; then
  echo "UNKNOWN: Info.plist not found at $PLIST"
  exit 2
fi

get_version() {
  /usr/libexec/PlistBuddy -c 'Print :KSVersion' "$PLIST" 2>/dev/null || \
  /usr/libexec/PlistBuddy -c 'Print :CFBundleShortVersionString' "$PLIST" 2>/dev/null || \
  defaults read "$APP_PATH/Contents/Info" KSVersion 2>/dev/null || \
  defaults read "$APP_PATH/Contents/Info" CFBundleShortVersionString 2>/dev/null
}

normalize_version() {
  local v="$1"
  IFS='.' read -r a b c d <<< "$v"
  a=${a:-0}; b=${b:-0}; c=${c:-0}; d=${d:-0}
  printf '%d.%d.%d.%d\n' "$a" "$b" "$c" "$d"
}

version_lt() {
  local v1 v2 IFS=.
  read -r -a v1 <<< "$(normalize_version "$1")"
  read -r -a v2 <<< "$(normalize_version "$2")"
  for i in 0 1 2 3; do
    if (( v1[i] < v2[i] )); then
      return 0
    elif (( v1[i] > v2[i] )); then
      return 1
    fi
  done
  return 1
}

CURRENT_VERSION="$(get_version | head -n1 | tr -d '[:space:]')"

if [[ -z "$CURRENT_VERSION" ]]; then
  echo "UNKNOWN: Unable to determine Chrome version"
  exit 2
fi

if version_lt "$CURRENT_VERSION" "$REQUIRED_VERSION"; then
  echo "VULNERABLE: Chrome version $CURRENT_VERSION is earlier than $REQUIRED_VERSION"
  exit 1
else
  echo "PATCHED: Chrome version $CURRENT_VERSION is $REQUIRED_VERSION or newer"
  exit 0
fi

Sources

1. Google Chrome Releases - Stable Channel Update for Desktop (June 2, 2026)
2. Canadian Centre for Cyber Security AV26-544
3. CVE.org record
4. NVD record
5. CISA Known Exploited Vulnerabilities Catalog
6. FIRST EPSS overview
7. FIRST EPSS API documentation
8. Chromium issue tracker entry referenced by Google release note