Inappropriate implementation in Permissions in Google Chrome prior to 149

CVE-2026-11253 is a Chrome Permissions flaw affecting versions before 149.0.7827.53 on Linux and before the 149.0.7827.53/54 desktop rollout on Windows and macOS. The supplied CVE text says a remote attacker can leak cross-origin data through a crafted HTML page; the linked Chromium fix strongly suggests a navigation/permissions race where Chrome could commit permission-related changes against the wrong page URL after navigation.

I would *downgrade* this from the supplied MEDIUM 4.3 baseline to LOW for enterprise patch triage. The decisive friction is that this is still a browser-side, user-driven, low-confidentiality leak with no exploit evidence, no KEV listing, no public weaponization, and a bug shape that looks timing-sensitive; that is not where a 10,000-endpoint team burns emergency patch capital.

Why this verdict

• Attacker position is still pre-exploitation web content, but it requires a browsing victim. UI:R means phishing, malvertising, or lure traffic first; this is immediate downward pressure versus a no-click browser bug.
• The prerequisite implies a narrow reachable population per attempt. The attacker does not hit all Chrome installs; they hit only users who land on the malicious page and then satisfy the timing needed for the permissions flow.
• The bug shape looks brittle. The official fix ties the permission commit to the original top-level URL, which strongly suggests a race during navigation; races are materially harder to weaponize and scale than straight logic bypasses.
• Impact is confidentiality-only and low-grade. The supplied vector is C:L/I:N/A:N, so even successful exploitation does not buy code execution, persistence, or broad integrity damage.
• No modern exposure amplifier is present. No KEV, no public PoC, no field exploitation, and no indication of mass scanning or turnkey operator use.

Why not higher?

This is not an RCE, not a sandbox escape, and not a zero-click browser bug. The attack requires a victim session, a crafted page, and what looks like a narrow timing condition tied to permission state and navigation, so the practical blast radius is far below Chrome's truly urgent memory corruption issues.

Why not lower?

It is still a remotely triggerable browser privacy boundary failure in one of the most widely deployed enterprise applications on earth. If you leave old Chrome versions lying around on unmanaged endpoints, an attacker can still try to steal cross-origin data from active browsing sessions, so this is not something to ignore outright.

1. Enforce browser auto-update — Make sure Chrome stable updates are not pinned behind stale rings or disabled by policy. For a LOW verdict there is no SLA (treat as backlog hygiene), but this is the cheapest control to reduce lingering exposure without waiting for a special project.
2. Find version-pinned laggards — Query EDR, software inventory, or Chrome enterprise reporting for endpoints below 149.0.7827.53. There is no mitigation SLA (backlog hygiene) here, so use normal operations time to clean up exceptions rather than launching an incident sprint.
3. Reduce unmanaged browsing risk — Apply standard web protections such as URL filtering, browser isolation for high-risk groups, and least-privilege browsing on contractor/BYOD edges. These controls reduce the probability that a user ever lands on the malicious page while you remediate through normal patching hygiene.
4. Monitor permission-prompt anomalies — If your browser telemetry stack supports it, look for unusual permission prompt patterns or rapid navigation changes tied to suspicious domains. This will not prove exploitation, but it can help surface attempted weaponization during the backlog window.

Run this from the target endpoint itself or through your EDR live-response shell. Invoke it as python3 check_chrome_cve_2026_11253.py; it needs only normal user rights because it reads executable paths and runs --version.

#!/usr/bin/env python3
# check_chrome_cve_2026_11253.py
# Detect Chrome/Chromium versions affected by CVE-2026-11253.
# Outputs one of: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import shutil
import subprocess
import sys
from typing import List, Optional, Tuple

FIXED = (149, 0, 7827, 53)
VERSION_RE = re.compile(r'(\d+)\.(\d+)\.(\d+)\.(\d+)')


def parse_version(text: str) -> Optional[Tuple[int, int, int, int]]:
    m = VERSION_RE.search(text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def run_version_cmd(path: str) -> Optional[str]:
    try:
        out = subprocess.check_output([path, '--version'], stderr=subprocess.STDOUT, text=True, timeout=10)
        return out.strip()
    except Exception:
        return None


def candidate_paths() -> List[str]:
    system = platform.system().lower()
    paths = []

    if system == 'windows':
        envs = [
            os.environ.get('PROGRAMFILES'),
            os.environ.get('PROGRAMFILES(X86)'),
            os.environ.get('LOCALAPPDATA')
        ]
        suffixes = [
            r'Google\Chrome\Application\chrome.exe',
            r'Chromium\Application\chrome.exe'
        ]
        for base in envs:
            if not base:
                continue
            for suffix in suffixes:
                paths.append(os.path.join(base, suffix))
    elif system == 'darwin':
        paths.extend([
            '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
            '/Applications/Chromium.app/Contents/MacOS/Chromium',
            os.path.expanduser('~/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'),
            os.path.expanduser('~/Applications/Chromium.app/Contents/MacOS/Chromium')
        ])
    else:
        binaries = [
            'google-chrome', 'google-chrome-stable', 'chromium', 'chromium-browser', 'chrome'
        ]
        for b in binaries:
            resolved = shutil.which(b)
            if resolved:
                paths.append(resolved)
        paths.extend([
            '/opt/google/chrome/chrome',
            '/usr/bin/google-chrome',
            '/usr/bin/google-chrome-stable',
            '/usr/bin/chromium',
            '/usr/bin/chromium-browser'
        ])

    # Deduplicate while preserving order
    seen = set()
    uniq = []
    for p in paths:
        if p and p not in seen:
            seen.add(p)
            uniq.append(p)
    return uniq


def main() -> int:
    found = []
    for path in candidate_paths():
        if not os.path.exists(path):
            continue
        out = run_version_cmd(path)
        if not out:
            continue
        ver = parse_version(out)
        if ver:
            found.append((path, out, ver))

    if not found:
        print('UNKNOWN - Chrome/Chromium executable not found or version unreadable')
        return 2

    vulnerable = []
    patched = []
    for path, raw, ver in found:
        if ver < FIXED:
            vulnerable.append((path, raw))
        else:
            patched.append((path, raw))

    if vulnerable:
        print('VULNERABLE')
        for path, raw in vulnerable:
            print(f'  {path} -> {raw}')
        return 1

    print('PATCHED')
    for path, raw in patched:
        print(f'  {path} -> {raw}')
    return 0


if __name__ == '__main__':
    sys.exit(main())

Sources

1. Chrome Releases: Stable Channel Update for Desktop (June 2, 2026)
2. Chrome Releases: Early Stable Update for Desktop (May 20, 2026)
3. Chrome for Developers: Change in release schedule from Chrome 110
4. Chromium commit fixing bug 498397912
5. Chromium code review for fix 498397912
6. Chromium issue 498397912
7. Chrome Releases homepage / archive