Insufficient validation of untrusted input in Loader in Google Chrome prior to 149

CVE-2026-11240 is a Loader input-validation flaw in Google Chrome that affects versions before 149.0.7827.53. Per the CVE description, the attacker must already have compromised the renderer process and then use a crafted HTML page to bypass Site Isolation, Chrome's boundary meant to keep one site's data away from another even if the renderer is hostile.

Google's LOW / 3.1 label is basically right, and if anything a little generous for patch-priority purposes. The decisive friction is that this is not an initial-access bug and not even a standalone code-exec bug; it is a post-renderer-compromise boundary bypass that only matters when chained with another vulnerability, which sharply narrows the real exposed population despite Chrome's massive install base.

Why this verdict

• Major friction: requires a compromised renderer first — attacker position is no longer simple unauthenticated remote; it implies an earlier successful exploit stage and sharply narrows real deployments that can reach this bug.
• High-complexity chain — the vendor vector already says AC:H and UI:R, and this sits behind both a user visit and a separate exploit, so each prerequisite compounds downward pressure on patch priority.
• Blast radius is browser-session confidentiality, not host takeover — the practical outcome is cross-site data exposure inside the browser boundary, not broad code execution on the endpoint.

Why not higher?

There is no evidence this bug is being exploited on its own, and there is no sign of KEV-level campaign use. More importantly, an attacker must first clear the much harder hurdle of renderer compromise, which means this CVE is a chain enhancer rather than the thing that gets them in.

Why not lower?

It still weakens a meaningful Chrome security boundary: Site Isolation exists specifically to contain hostile renderer processes. In a real exploit chain, bypassing that boundary can turn a contained renderer bug into cross-origin data theft, so this is not pure noise.

1. Enforce browser auto-update — Make sure enterprise Chrome update policy is not pinned below the fixed build and that stalled channels are corrected. For a LOW verdict there is no mitigation SLA and no remediation SLA beyond backlog hygiene, so fold this into your normal browser maintenance cycle rather than interrupt work.
2. Keep Site Isolation policy enabled — Verify admins have not weakened Chrome isolation settings for compatibility or memory-saving reasons. This does not fix the bug, but it preserves the broader architectural control and should remain enforced as standard baseline hygiene.
3. Prioritize upstream renderer bugs higher — Because this CVE only pays off after renderer compromise, your real risk reducer is fast handling of renderer RCE / sandbox / V8 issues that can serve as the first stage. Treat this finding as chain-hardening and let the more dangerous first-stage Chrome bugs drive urgency.

Run this on the target endpoint or through your endpoint management runner. Invoke it with python3 chrome_check.py or python chrome_check.py; no admin rights are usually needed as long as the Chrome binary is readable. It checks common Chrome install paths, runs --version, and prints VULNERABLE, PATCHED, or UNKNOWN.

#!/usr/bin/env python3
# chrome_check.py
# Check whether local Google Chrome is at or above the fixed version for CVE-2026-11240.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import shutil
import subprocess
import sys

FIXED_VERSION = (149, 0, 7827, 53)


def parse_version(text):
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def run_version_cmd(path):
    try:
        result = subprocess.run([path, '--version'], capture_output=True, text=True, timeout=10)
        output = (result.stdout or '') + ' ' + (result.stderr or '')
        return parse_version(output.strip())
    except Exception:
        return None


def candidate_paths():
    system = platform.system()
    paths = []

    if system == 'Windows':
        env_paths = [
            os.path.join(os.environ.get('ProgramFiles', r'C:\Program Files'), 'Google', 'Chrome', 'Application', 'chrome.exe'),
            os.path.join(os.environ.get('ProgramFiles(x86)', r'C:\Program Files (x86)'), 'Google', 'Chrome', 'Application', 'chrome.exe'),
            os.path.join(os.environ.get('LocalAppData', ''), 'Google', 'Chrome', 'Application', 'chrome.exe'),
        ]
        paths.extend(env_paths)
    elif system == 'Darwin':
        paths.extend([
            '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
            os.path.expanduser('~/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'),
        ])
    else:
        for name in ['google-chrome', 'google-chrome-stable', 'chromium-browser', 'chromium']:
            resolved = shutil.which(name)
            if resolved:
                paths.append(resolved)
        paths.extend([
            '/opt/google/chrome/chrome',
            '/usr/bin/google-chrome',
            '/usr/bin/google-chrome-stable',
        ])

    # Deduplicate while preserving order
    seen = set()
    uniq = []
    for p in paths:
        if p and p not in seen:
            seen.add(p)
            uniq.append(p)
    return uniq


def main():
    found = []
    for path in candidate_paths():
        if os.path.exists(path) or shutil.which(path):
            version = run_version_cmd(path)
            if version:
                found.append((path, version))

    if not found:
        print('UNKNOWN - Google Chrome not found or version could not be determined')
        sys.exit(2)

    # Evaluate the highest version found
    found.sort(key=lambda x: x[1], reverse=True)
    path, version = found[0]
    version_str = '.'.join(str(x) for x in version)
    fixed_str = '.'.join(str(x) for x in FIXED_VERSION)

    if version >= FIXED_VERSION:
        print(f'PATCHED - {path} version {version_str} >= fixed {fixed_str}')
        sys.exit(0)
    else:
        print(f'VULNERABLE - {path} version {version_str} < fixed {fixed_str}')
        sys.exit(1)


if __name__ == '__main__':
    main()

Sources

1. Google Chrome Releases - Stable Channel Update for Desktop (June 2, 2026)
2. Google Chrome Releases - Early Stable Update for Desktop (May 29, 2026)
3. Canadian Centre for Cyber Security advisory AV26-544
4. Chromium Site Isolation overview
5. Chromium Site Isolation design document
6. CISA Known Exploited Vulnerabilities Catalog
7. Chromium issue tracker entry 497030032