Insufficient validation of untrusted input in Cast in Google Chrome prior to 149

CVE-2026-11259 is an improper input validation flaw in Chrome's Cast component that can let a remote attacker bypass same-origin policy by getting a user onto a crafted HTML page. Based on Google's advisory and NVD, affected builds are Google Chrome prior to 149.0.7827.53; Google shipped fixes in 149.0.7827.53 for Linux and 149.0.7827.53/54 for Windows and macOS.

The vendor's MEDIUM 4.3 is already conservative, and in real enterprise conditions I'd actually push it down to LOW. The decisive friction is that this is still a client-side, user-driven browser bug in a specific feature area, with no code execution, no privilege gain, no published in-the-wild exploitation, and no meaningful internet-exposed service surface to mass-scan or automate against.

Why this verdict

• User interaction required: this is UI:R, so there is no wormable or unauthenticated drive-by service surface to hammer at scale without first winning user navigation.
• Feature-path friction: the bug sits in Cast, which narrows reachable population versus a core renderer, network stack, or PDF parser flaw that every page can hit more predictably.
• Impact is bounded: published scoring indicates same-origin policy bypass / low integrity impact, not sandbox escape, host compromise, or broad data theft.
• No active exploitation signal: not in KEV, no public Google warning about in-the-wild abuse, and user-supplied EPSS 0.0002 is exceptionally low.
• No edge exposure: this is a client browser bug, so the usual internet census amplifiers — Shodan mass visibility, exposed admin ports, unauthenticated perimeter reachability — do not apply.

Why not higher?

A higher severity would need a stronger amplifier: active exploitation, a public exploit chain, broad feature reachability, or materially worse impact such as code execution or sandbox escape. We have none of those. The path is real, but it is still a user-mediated browser exploit with constrained blast radius and no evidence of operationalized abuse.

Why not lower?

I would not drop this to IGNORE because it is still remote content-triggerable and same-origin bypasses can matter when users are authenticated to internal or SaaS apps. On a 10,000-host fleet, even low-probability browser bugs deserve version hygiene because browsers are high-frequency attack surfaces.

1. Verify Chrome auto-update health — Make sure managed endpoints are actually taking Chrome updates and not stalled on dead rings or disabled Google Update services. For a LOW verdict there is no mitigation SLA; use normal fleet hygiene and confirm version drift is collapsing during your routine browser maintenance cycle.
2. Prefer stable browser rings for high-risk users — Executives, admins, finance, and developer endpoints are more likely to be targeted with malicious links and docs, so keep them on the fastest-supported stable update cadence. Even without a dated LOW-finding SLA, this reduces exposure to the entire class of browser-content attacks, not just this CVE.
3. Keep SWG and Safe Browsing controls enforced — This vulnerability still needs a hostile page delivery path, so URL filtering, DNS filtering, category blocking, and browser reputation services remain worthwhile choke points. Maintain them as standing controls; they reduce commodity exploit reach while patching catches up through normal operations.
4. Monitor version inventory, not perimeter scans — Because this is a client-side browser flaw, your success metric is endpoint version coverage from EDR, MDM, SCCM/Intune, Jamf, or package inventory. For a LOW verdict, track stragglers and remediate them in standard desktop backlog rather than creating a special emergency campaign.

Run this on the target endpoint or through your software management agent. Invoke it with python3 chrome_cve_2026_11259_check.py on macOS/Linux or py chrome_cve_2026_11259_check.py on Windows; no admin privileges are required as long as the current user can execute Chrome's binary or read its app metadata.

#!/usr/bin/env python3
# Check Google Chrome version against CVE-2026-11259 fixed floor.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import subprocess
import sys
from pathlib import Path

FIXED = (149, 0, 7827, 53)


def parse_version(text):
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def run_version(cmd):
    try:
        p = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True, timeout=5)
        return p.stdout.strip()
    except Exception:
        return None


def get_windows_version():
    candidates = [
        Path(os.environ.get('ProgramFiles', 'C:\\Program Files')) / 'Google/Chrome/Application/chrome.exe',
        Path(os.environ.get('ProgramFiles(x86)', 'C:\\Program Files (x86)')) / 'Google/Chrome/Application/chrome.exe',
        Path(os.environ.get('LocalAppData', '')) / 'Google/Chrome/Application/chrome.exe',
    ]
    for path in candidates:
        if path and path.exists():
            out = run_version([str(path), '--version'])
            if out:
                return out, str(path)
    return None, None


def get_macos_version():
    candidates = [
        '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
        str(Path.home() / 'Applications/Google Chrome.app/Contents/MacOS/Google Chrome'),
    ]
    for path in candidates:
        if os.path.exists(path):
            out = run_version([path, '--version'])
            if out:
                return out, path
    return None, None


def get_linux_version():
    candidates = [
        ['google-chrome', '--version'],
        ['google-chrome-stable', '--version'],
        ['/usr/bin/google-chrome', '--version'],
        ['/usr/bin/google-chrome-stable', '--version'],
    ]
    for cmd in candidates:
        out = run_version(cmd)
        if out:
            return out, cmd[0]
    return None, None


def compare_versions(found, fixed):
    if found < fixed:
        return 'VULNERABLE'
    return 'PATCHED'


def main():
    system = platform.system().lower()

    if 'windows' in system:
        out, loc = get_windows_version()
    elif 'darwin' in system:
        out, loc = get_macos_version()
    elif 'linux' in system:
        out, loc = get_linux_version()
    else:
        print('UNKNOWN - unsupported operating system')
        sys.exit(2)

    if not out:
        print('UNKNOWN - Google Chrome not found')
        sys.exit(2)

    ver = parse_version(out)
    if not ver:
        print(f'UNKNOWN - unable to parse version from: {out}')
        sys.exit(2)

    status = compare_versions(ver, FIXED)
    version_str = '.'.join(str(x) for x in ver)
    fixed_str = '.'.join(str(x) for x in FIXED)
    print(f'{status} - installed={version_str} fixed_floor={fixed_str} path={loc}')

    if status == 'PATCHED':
        sys.exit(0)
    elif status == 'VULNERABLE':
        sys.exit(1)
    else:
        sys.exit(2)


if __name__ == '__main__':
    main()

Sources

1. NVD CVE-2026-11259
2. Google Chrome Releases - Stable Channel Update for Desktop (June 2, 2026)
3. Google Chrome Releases - Early Stable Update for Desktop (May 29, 2026)
4. Chromium issue 499215943
5. CISA Known Exploited Vulnerabilities Catalog
6. FIRST EPSS API documentation
7. Canadian Centre for Cyber Security advisory AV26-544
8. SecurityWeek - Chrome 149 Patches 429 Vulnerabilities