Inappropriate implementation in Payments in Google Chrome prior to 149

Per the supplied intel, CVE-2026-11245 is an *inappropriate implementation* flaw in Payments in Google Chrome that affects versions prior to 149.0.7827.53 and enables UI spoofing via a crafted HTML page. That puts this squarely in the CWE-451 family: the browser can present misleading trust or payment-related UI badly enough that a malicious page can impersonate something the user should trust. Based on the provided CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N, this is remote and low-complexity, but it still depends on the victim being tricked into interacting with the spoofed flow.

The vendor's MEDIUM 4.3 baseline is slightly generous for enterprise patch prioritization. In real fleets, this is not remote code execution, not sandbox escape, not credential dumping, and not a direct browser-to-host compromise; it is a social-engineering multiplier that makes payment or consent prompts more believable. Chrome's install base is enormous, which keeps it above IGNORE, but the combination of user interaction, integrity-only impact, no KEV listing, and very low EPSS pushes this down to LOW for patch-triage purposes.

Why this verdict

• User interaction required: the supplied vector includes UI:R, which means the exploit chain still depends on a human being fooled into acting; that is a major real-world downgrade from purely technical browser compromise.
• Integrity-only impact: the supplied vector shows C:N/I:L/A:N, so this does not directly expose data, execute code, or crash hosts. The main harm is manipulating a decision or trust signal.
• Client-side reachability is narrower than the install base suggests: yes, Chrome is everywhere, but this is not an unauthenticated service you can sweep with mass scanners. It only matters on endpoints that both browse to attacker content and hit the vulnerable Payments UI path.
• No exploitation pressure signals: no KEV entry, no public PoC located, and an EPSS of 0.00022 all argue against emergency handling.
• Comparable Chrome history points to nuisance-class browser security UX bugs: prior Payments/UI spoofing issues in Chrome have landed in the medium-to-low practical risk band rather than the breakout/RCE band.

Why not higher?

There is no evidence here of code execution, sandbox escape, privilege gain, persistence, or confidentiality impact. The attacker must both deliver the lure and win the human decision, which is materially different from a browser bug that compromises the endpoint on page load.

Why not lower?

This still lives in Chrome, one of the highest-volume enterprise clients you own, and it targets payment trust cues, which can convert directly into fraud or bad approvals. A browser trust-boundary failure with broad fleet prevalence deserves tracking and patching, even if it is not an urgent fire drill.

1. Force browser auto-update — Use managed Chrome policies and endpoint management to keep stable-channel updates flowing without waiting for user action. For a LOW noisgate verdict there is no SLA; treat this as backlog hygiene and fold it into your standard browser update cadence.
2. Route risky browsing through SWG or RBI — Apply secure web gateway filtering or remote browser isolation for untrusted categories, newly registered domains, and payment-themed lures to cut off delivery before the spoof is rendered. For LOW, there is no SLA; deploy where you already have the stack rather than launching a net-new emergency project.
3. Harden payment workflows — Require out-of-band approval, transaction review, and card-use controls for sensitive purchasing flows so a misleading browser prompt does not directly become a fraudulent payment. For LOW, there is no SLA; prioritize this in business units that use browser-based procurement heavily.
4. Trim stored payment surfaces — Reduce reliance on browser-stored payment methods and auto-fill for high-risk populations if your risk model allows it, because fewer embedded payment affordances means less value in spoofing them. For LOW, there is no SLA; apply selectively to finance, procurement, and admin cohorts.

Run this on the target endpoint or through your software inventory/remote execution platform. Invoke it with python3 check_chrome_cve_2026_11245.py on macOS/Linux or py check_chrome_cve_2026_11245.py on Windows; standard user rights are usually enough, though some Windows install locations or registry paths may be easier to read with local admin.

#!/usr/bin/env python3
# check_chrome_cve_2026_11245.py
# Detect whether installed Google Chrome is below 149.0.7827.53.
# Outputs one of: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import subprocess
import sys

THRESHOLD = (149, 0, 7827, 53)
VERSION_RE = re.compile(r'(\d+)\.(\d+)\.(\d+)\.(\d+)')


def parse_version(text):
    if not text:
        return None
    m = VERSION_RE.search(text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def cmp_ver(a, b):
    return (a > b) - (a < b)


def run_cmd(cmd):
    try:
        p = subprocess.run(cmd, capture_output=True, text=True, timeout=10)
        out = (p.stdout or '') + ' ' + (p.stderr or '')
        return parse_version(out.strip())
    except Exception:
        return None


def windows_candidates():
    candidates = []
    for base in [
        os.environ.get('ProgramFiles'),
        os.environ.get('ProgramFiles(x86)'),
        os.environ.get('LocalAppData')
    ]:
        if base:
            candidates.append(os.path.join(base, 'Google', 'Chrome', 'Application', 'chrome.exe'))
    return candidates


def mac_candidates():
    return [
        '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
        os.path.expanduser('~/Applications/Google Chrome.app/Contents/MacOS/Google Chrome')
    ]


def linux_candidates():
    return [
        'google-chrome',
        'google-chrome-stable',
        '/usr/bin/google-chrome',
        '/usr/bin/google-chrome-stable',
        '/opt/google/chrome/chrome'
    ]


def get_version_windows():
    # Try executable --version first
    for path in windows_candidates():
        if os.path.exists(path):
            v = run_cmd([path, '--version'])
            if v:
                return v, path

    # Try registry via PowerShell if available
    ps = [
        'powershell', '-NoProfile', '-Command',
        r"$paths=@('HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome',"
        r"'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome',"
        r"'HKCU:\Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome');"
        r"foreach($p in $paths){if(Test-Path $p){$v=(Get-ItemProperty $p).DisplayVersion; if($v){Write-Output $v; break}}}"
    ]
    v = run_cmd(ps)
    if v:
        return v, 'registry'

    return None, None


def get_version_mac():
    for path in mac_candidates():
        if os.path.exists(path):
            v = run_cmd([path, '--version'])
            if v:
                return v, path
    return None, None


def get_version_linux():
    for path in linux_candidates():
        v = run_cmd([path, '--version'])
        if v:
            return v, path
    return None, None


def main():
    system = platform.system().lower()
    version = None
    source = None

    if 'windows' in system:
        version, source = get_version_windows()
    elif 'darwin' in system or 'mac' in system:
        version, source = get_version_mac()
    elif 'linux' in system:
        version, source = get_version_linux()
    else:
        print('UNKNOWN: unsupported platform')
        sys.exit(2)

    if not version:
        print('UNKNOWN: Google Chrome version not found')
        sys.exit(2)

    version_str = '.'.join(str(x) for x in version)
    if cmp_ver(version, THRESHOLD) < 0:
        print(f'VULNERABLE: Google Chrome {version_str} detected via {source}; requires >= 149.0.7827.53')
        sys.exit(1)
    else:
        print(f'PATCHED: Google Chrome {version_str} detected via {source}; meets >= 149.0.7827.53')
        sys.exit(0)


if __name__ == '__main__':
    main()

Sources

1. Chrome Releases: Stable Channel Update for Desktop (June 2, 2026)
2. Chrome Releases: Early Stable Update for Desktop (May 29, 2026)
3. Chromium Security
4. CISA Known Exploited Vulnerabilities Catalog
5. FIRST EPSS API documentation
6. MITRE CWE-451: UI Misrepresentation of Critical Information
7. NVD: CVE-2025-0442
8. Chrome Releases: Stable Channel Update for Desktop (January 14, 2025)