Insufficient policy enforcement in Compositing in Google Chrome prior to 149

CVE-2026-11235 is an insufficient policy enforcement flaw in Chrome Compositing affecting Google Chrome versions prior to 149.0.7827.53. The key clause is the whole story: the attacker must have already compromised the renderer process first, and only then can a crafted HTML page be used to gain arbitrary code execution inside a sandbox. That makes this a post-compromise browser-chain primitive, not a one-bug remote workstation takeover.

The published 8.8 HIGH CVSS overstates enterprise urgency if you are scheduling patches across a real fleet. Chrome's own CVE text labels the underlying Chromium security severity as Low, and that lines up better with reality: this bug assumes a prior exploit stage, preserves sandbox confinement, has no known KEV entry, and has extremely low EPSS. It matters to exploit developers building multi-bug chains; it is not the thing that gets an attacker into your environment by itself.

Why this verdict

• Requires prior compromise: the CVE text explicitly requires the attacker to have already compromised the renderer process, which implies a separate exploit stage and is strong downward pressure from the 8.8 baseline.
• Still sandboxed: successful exploitation yields arbitrary code execution *inside a sandbox*, not a clean host escape. That sharply limits stand-alone business impact.
• No exploitation signal: no KEV listing, no public exploitation evidence found, and the supplied EPSS 0.00078 is tiny.
• Exposure is broad but not reachable in the same way as a server bug: Chrome is everywhere, but this is not an unauthenticated internet-facing service that attackers can mass-scan and smash directly.
• Detection opportunity compounds across stages: a real attack needs renderer compromise first and likely a follow-on sandbox escape or credential theft second, creating more breakpoints for browser protections and EDR.

Why not higher?

A HIGH or CRITICAL verdict would fit a browser bug that gives unauthenticated remote code execution on first contact or breaks out of the sandbox directly. This one does neither. Its own description bakes in a prior exploit requirement and leaves the attacker sandboxed, which is exactly the kind of friction that should crush a vacuum-severity score.

Why not lower?

It is still a real security boundary failure in a massively deployed client, and it could be useful in a chained campaign. If an attacker already has a renderer foothold, this CVE may help stabilize or extend that position. That keeps it above IGNORE and worth normal patch hygiene.

1. Enforce Chrome auto-update — Pin managed endpoints to current stable and verify update compliance through enterprise browser policy. For a LOW verdict there is no SLA; treat as backlog hygiene, but this is still the cleanest control because version drift is the only broad exposure condition.
2. Harden browser process isolation — Keep Chrome sandboxing, site isolation, and exploit-protection features enabled everywhere; do not relax them for compatibility unless there is an exception record. This reduces the value of post-renderer-compromise bugs like this one and should be maintained continuously.
3. Prioritize unmanaged browsing populations — Focus first on high-risk user groups that browse unknown content, use developer features, or run without strong EDR/browser management. For LOW, fold this into normal remediation planning rather than emergency action.
4. Watch for chained browser detections — Tune EDR and browser telemetry for exploit chains, suspicious renderer crashes, and abnormal Chrome child-process activity. This matters because the real risk comes from combinations, not this CVE in isolation.

Run this on the target endpoint or via your software-distribution/EDR remote execution channel. Invoke it as python3 check_cve_2026_11235.py on Linux/macOS or py check_cve_2026_11235.py on Windows; no administrative privileges are required if the Chrome binary is in a standard location.

#!/usr/bin/env python3
# check_cve_2026_11235.py
# Detects whether local Google Chrome version is vulnerable to CVE-2026-11235.
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN

import os
import platform
import re
import shutil
import subprocess
import sys
from typing import Optional, Tuple, List

THRESHOLD = (149, 0, 7827, 53)


def parse_version(text: str) -> Optional[Tuple[int, int, int, int]]:
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def run_and_get_version(cmd: List[str]) -> Optional[Tuple[int, int, int, int]]:
    try:
        p = subprocess.run(cmd, capture_output=True, text=True, timeout=10)
    except Exception:
        return None
    out = (p.stdout or '') + '\n' + (p.stderr or '')
    return parse_version(out)


def candidate_commands() -> List[List[str]]:
    system = platform.system().lower()
    cmds: List[List[str]] = []

    if system == 'windows':
        env = os.environ
        candidates = [
            os.path.join(env.get('ProgramFiles', 'C:\\Program Files'), 'Google', 'Chrome', 'Application', 'chrome.exe'),
            os.path.join(env.get('ProgramFiles(x86)', 'C:\\Program Files (x86)'), 'Google', 'Chrome', 'Application', 'chrome.exe'),
            os.path.join(env.get('LocalAppData', ''), 'Google', 'Chrome', 'Application', 'chrome.exe'),
        ]
        for path in candidates:
            if path and os.path.exists(path):
                cmds.append([path, '--version'])
        for exe in ['chrome', 'chrome.exe']:
            found = shutil.which(exe)
            if found:
                cmds.append([found, '--version'])

    elif system == 'darwin':
        candidates = [
            '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
            os.path.expanduser('~/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'),
        ]
        for path in candidates:
            if os.path.exists(path):
                cmds.append([path, '--version'])
        found = shutil.which('google-chrome')
        if found:
            cmds.append([found, '--version'])

    else:
        for exe in ['google-chrome', 'google-chrome-stable', 'chrome', 'chromium', 'chromium-browser']:
            found = shutil.which(exe)
            if found:
                cmds.append([found, '--version'])
        for path in [
            '/opt/google/chrome/chrome',
            '/usr/bin/google-chrome',
            '/usr/bin/google-chrome-stable',
        ]:
            if os.path.exists(path):
                cmds.append([path, '--version'])

    # Deduplicate while preserving order
    unique = []
    seen = set()
    for cmd in cmds:
        key = tuple(cmd)
        if key not in seen:
            seen.add(key)
            unique.append(cmd)
    return unique


def main() -> int:
    versions = []
    for cmd in candidate_commands():
        ver = run_and_get_version(cmd)
        if ver:
            versions.append((cmd[0], ver))

    if not versions:
        print('UNKNOWN - Google Chrome not found or version unreadable')
        return 2

    # Prefer the highest discovered version if multiple copies exist
    path, ver = sorted(versions, key=lambda x: x[1], reverse=True)[0]
    ver_str = '.'.join(str(x) for x in ver)
    threshold_str = '.'.join(str(x) for x in THRESHOLD)

    if ver < THRESHOLD:
        print(f'VULNERABLE - {path} version {ver_str} is older than fixed version {threshold_str}')
        return 1
    else:
        print(f'PATCHED - {path} version {ver_str} is at or newer than fixed version {threshold_str}')
        return 0


if __name__ == '__main__':
    sys.exit(main())

Sources

1. NVD CVE record
2. Chrome Stable Channel Update for Desktop
3. Chromium issue reference
4. Chrome Releases June 2026 archive
5. CISA Known Exploited Vulnerabilities catalog
6. FIRST EPSS project
7. SecurityWeek coverage of Chrome 149 release