Integer overflow in GPU in Google Chrome prior to 149

CVE-2026-11256 is a Chrome GPU-process memory-safety bug described by Google/NVD as an integer overflow or out-of-bounds read in GPU, fixed in Chrome 149.0.7827.53 for Linux and 149.0.7827.53/54 for Windows and macOS. The important part is the prerequisite buried in the description: the attacker must have already compromised the renderer process and then use a crafted HTML page to try to turn that foothold into a sandbox escape.

The vendor/CISA-ADP 8.3 HIGH score overstates the standalone enterprise patch priority. In practice this is a post-initial-code-execution browser escape primitive, not a first-hop internet-facing compromise path. Google itself tagged the underlying Chromium issue as Low severity, there is no KEV listing, the supplied EPSS is tiny, and there is no public exploitation evidence in the source set reviewed here. The reach is broad because Chrome is everywhere; the exploit chain is narrow because this bug is only useful after step one already succeeded.

Why this verdict

• Major downward adjustment: requires prior renderer compromise. That implies a separate exploit or earlier stage has already succeeded, making this post-initial-access within the browser trust boundary rather than a direct one-bug intrusion path.
• Population narrowing. Chrome is ubiquitous, but only the subset on vulnerable builds *and* reachable with a working renderer exploit chain can be hit; that is far smaller than the raw install base suggests.
• No active exploitation amplifier. Not KEV-listed, no confirmed in-the-wild use found, and user-supplied EPSS is extremely low, so there is no current threat-intel reason to keep the vendor HIGH intact.
• Modern controls still have interception points. Safe Browsing, browser auto-update, EDR, exploit mitigations, and process-behavior monitoring all have chances to break the full chain before host-level impact.
• Google's own bug taxonomy is a tell. The Chrome release notes classify this issue as Low, which aligns better with a limited, chained escape primitive than with a broadly weaponizable first-hop browser RCE.

Why not higher?

There is no evidence here of active exploitation, no public PoC in the reviewed sources, and no direct unauthenticated one-bug code-execution path from web content to host escape. The need for a pre-existing renderer compromise is compounded friction, and compounded friction is exactly what should drag enterprise priority down.

Why not lower?

It still lives in Chrome, one of the highest-value and most broadly deployed user attack surfaces in the enterprise. If paired with a renderer bug, the impact can become serious quickly, so this is not backlog-trash; it belongs in normal browser patch hygiene, not in ignore-land.

1. Enforce rapid Chrome auto-update — Make sure enterprise policy is not delaying browser self-updates and that devices converge on 149.0.7827.53/54 through the normal browser channel. For a MEDIUM noisgate verdict there is no mitigation SLA; use this as routine exposure reduction while working inside the <=365 day remediation window.
2. Watch for renderer-to-GPU crash clusters — Correlate browser crash telemetry, GPU-process instability, and suspicious browsing events on vulnerable versions. This will not prevent exploitation, but it can surface exploit development or failed chains while you complete remediation; again, no mitigation SLA applies for MEDIUM.
3. Keep EDR tuned on browser child-process and file-access anomalies — If a sandbox escape succeeds, defenders usually win on the *post-escape behavior*, not on the memory bug itself. Validate detections for unusual Chrome process ancestry, LOLBin launches, credential store access, and writes outside normal profile paths; this is compensating coverage until patched.
4. Reduce unmanaged browser variance — Collapse straggler channels, unmanaged portable installs, and frozen VDI images into your standard browser lifecycle. The biggest practical risk with Chrome flaws is usually not exploit sophistication but fleet drift.

Run this on the target endpoint or through your software inventory agent, not from an external auditor box. Invoke it with python3 check_chrome_cve_2026_11256.py on the host; no admin rights are usually needed, though wider path access helps on shared systems. The script checks local Chrome/Chromium version(s) and reports VULNERABLE, PATCHED, or UNKNOWN.

#!/usr/bin/env python3
# check_chrome_cve_2026_11256.py
# Determine local exposure to CVE-2026-11256 based on installed Chrome/Chromium version.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import shutil
import subprocess
import sys
from pathlib import Path

TARGET_CVE = 'CVE-2026-11256'
FIX_LINUX = (149, 0, 7827, 53)
FIX_WIN_MAC = (149, 0, 7827, 53)  # advisory says Windows/Mac 149.0.7827.53/54; .53 is sufficient baseline


def parse_version(text):
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def version_lt(a, b):
    return a < b


def run_cmd(cmd):
    try:
        p = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, timeout=10)
        out = (p.stdout or '') + (p.stderr or '')
        return out.strip()
    except Exception:
        return ''


def candidate_commands():
    system = platform.system().lower()
    cmds = []

    if 'windows' in system:
        env = os.environ
        possible = [
            Path(env.get('ProgramFiles', 'C:\\Program Files')) / 'Google/Chrome/Application/chrome.exe',
            Path(env.get('ProgramFiles(x86)', 'C:\\Program Files (x86)')) / 'Google/Chrome/Application/chrome.exe',
            Path(env.get('LocalAppData', '')) / 'Google/Chrome/Application/chrome.exe',
            Path(env.get('ProgramFiles', 'C:\\Program Files')) / 'Chromium/Application/chrome.exe',
        ]
        for p in possible:
            if str(p) and p.exists():
                cmds.append([str(p), '--version'])
        for exe in ['chrome', 'chrome.exe']:
            path = shutil.which(exe)
            if path:
                cmds.append([path, '--version'])
    elif 'darwin' in system:
        possible = [
            '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
            '/Applications/Chromium.app/Contents/MacOS/Chromium',
            str(Path.home() / 'Applications/Google Chrome.app/Contents/MacOS/Google Chrome'),
        ]
        for p in possible:
            if os.path.exists(p):
                cmds.append([p, '--version'])
        for exe in ['google-chrome', 'chromium', 'chromium-browser', 'chrome']:
            path = shutil.which(exe)
            if path:
                cmds.append([path, '--version'])
    else:
        for exe in ['google-chrome', 'google-chrome-stable', 'chromium', 'chromium-browser', 'chrome']:
            path = shutil.which(exe)
            if path:
                cmds.append([path, '--version'])
        possible = [
            '/opt/google/chrome/chrome',
            '/usr/bin/google-chrome',
            '/usr/bin/google-chrome-stable',
            '/usr/bin/chromium',
            '/usr/bin/chromium-browser',
        ]
        for p in possible:
            if os.path.exists(p):
                cmds.append([p, '--version'])

    # de-duplicate while preserving order
    uniq = []
    seen = set()
    for c in cmds:
        key = tuple(c)
        if key not in seen:
            uniq.append(c)
            seen.add(key)
    return uniq


def main():
    system = platform.system().lower()
    fix_version = FIX_WIN_MAC if ('windows' in system or 'darwin' in system) else FIX_LINUX

    found = []
    for cmd in candidate_commands():
        out = run_cmd(cmd)
        ver = parse_version(out)
        if ver:
            found.append((cmd[0], ver, out))

    if not found:
        print(f'UNKNOWN: {TARGET_CVE} - Chrome/Chromium not found or version unreadable')
        sys.exit(2)

    vulnerable = []
    patched = []
    for path, ver, raw in found:
        if version_lt(ver, fix_version):
            vulnerable.append((path, ver, raw))
        else:
            patched.append((path, ver, raw))

    # If any installed instance is vulnerable, call host vulnerable.
    if vulnerable:
        for path, ver, raw in vulnerable:
            print(f'VULNERABLE: {path} -> {raw}')
        if patched:
            for path, ver, raw in patched:
                print(f'PATCHED: {path} -> {raw}')
        sys.exit(1)

    for path, ver, raw in patched:
        print(f'PATCHED: {path} -> {raw}')
    sys.exit(0)


if __name__ == '__main__':
    main()

Sources

1. NVD CVE-2026-11256
2. Chrome Releases: Stable Channel Update for Desktop (June 2, 2026)
3. Chromium issue reference 498856565
4. Canadian Centre for Cyber Security advisory AV26-544
5. FIRST EPSS API documentation
6. CISA KEV data mirror repository
7. CISA official KEV catalog