Inappropriate implementation in Permissions in Google Chrome prior to 149

CVE-2026-11260 is a Chrome Permissions policy-bypass bug that can let a remote attacker defeat Content Security Policy controls via a crafted HTML page. The affected range is Chrome prior to 149.0.7827.53 on Linux and prior to 149.0.7827.53/54 on Windows and macOS; downstream Chromium builds inherit the issue until their vendor ships the 149 fixes or backports them.

The vendor's MEDIUM 4.3 baseline is already conservative, and in enterprise reality I'd push it down another notch. The decisive friction is that this is *not* code execution, *not* sandbox escape, and *not* a direct origin compromise by itself; the attacker still needs a user to render attacker-controlled content and then needs a site or workflow where bypassing CSP actually changes the outcome.

Why this verdict

• User interaction required: the chain starts with a victim opening attacker HTML, which is immediate downward pressure versus silent drive-by RCE.
• Impact is narrow: vendor vector shows only I:L with no confidentiality or availability loss, so this is a browser-policy weakening issue, not host compromise.
• App-context dependency: bypassing CSP only matters where the target site or workflow actually relies on CSP for meaningful containment; many real deployments have additional controls.
• No exploitation signal: no KEV listing, no public exploit reporting, and an EPSS value near zero all argue against urgent attacker interest.
• Exposure is broad but shallow: Chrome is everywhere, which keeps this from being IGNORE, but browser ubiquity alone does not overcome the chain friction.

Why not higher?

If this were a renderer RCE, sandbox escape, same-origin bypass with data theft, or a KEV-listed browser 0-day, the call would move sharply upward. Here, the attacker gets a protection bypass with limited integrity impact and still needs a favorable web-app context, which is too much friction for MEDIUM or above in enterprise prioritization.

Why not lower?

I am not dropping this to IGNORE because browsers are high-frequency exposure points and a policy bypass can become useful when paired with weak web application design. Also, Chrome's install base means even a low-grade client-side bug can touch a very large victim population before auto-update converges.

1. Force browser auto-update compliance — Use your browser-management stack to verify Chrome/Chromium clients converge to 149.0.7827.53+ promptly. For a LOW verdict there is no SLA-driven emergency mitigation, but this should be handled as backlog hygiene and closed during normal endpoint maintenance.
2. Reduce untrusted web delivery — Tighten email-link detonation, safe browsing, and web filtering for newly registered domains and ad-tech heavy categories, because the exploit path begins with attacker HTML. Do this in normal operations; it reduces exposure even if some endpoints lag patching.
3. Prefer strict site isolation and enterprise browsing controls — Maintain browser hardening baselines such as site isolation defaults, extension allowlisting, and risky-site isolation through your enterprise browser policy set. These do not 'fix' the bug, but they reduce the odds that a CSP bypass cleanly chains into meaningful business impact.
4. Monitor version drift — Build a report for Chrome/Chromium versions older than 149.0.7827.53 across managed endpoints and VDI pools. For LOW, use standard patch hygiene cycles rather than an incident-style campaign.

Run this on the target endpoint or through your EDR/live-response shell. Invoke it with python3 check_chrome_cve_2026_11260.py on Linux/macOS or py check_chrome_cve_2026_11260.py on Windows; no admin rights are normally required, though some managed install paths may need read access.

#!/usr/bin/env python3
# check_chrome_cve_2026_11260.py
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN

import os
import platform
import re
import shutil
import subprocess
import sys

PATCH_MIN = (149, 0, 7827, 53)
WIN_ALT_PATCH = (149, 0, 7827, 54)  # Windows/macOS may report .54


def parse_version(text):
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text or '')
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def cmp_version(a, b):
    return (a > b) - (a < b)


def version_is_patched(v):
    if v is None:
        return None
    return cmp_version(v, PATCH_MIN) >= 0


def run(cmd):
    try:
        p = subprocess.run(cmd, capture_output=True, text=True, timeout=10)
        out = (p.stdout or '') + '\n' + (p.stderr or '')
        return out.strip()
    except Exception:
        return ''


def get_version_from_command(cmd):
    out = run(cmd)
    return parse_version(out), out


def get_windows_file_version(path):
    if not os.path.exists(path):
        return None, ''
    ps = [
        'powershell', '-NoProfile', '-Command',
        f"(Get-Item '{path}').VersionInfo.ProductVersion"
    ]
    out = run(ps)
    return parse_version(out), out


def collect_versions():
    findings = []
    system = platform.system().lower()

    if system == 'windows':
        paths = [
            os.path.expandvars(r'%ProgramFiles%\Google\Chrome\Application\chrome.exe'),
            os.path.expandvars(r'%ProgramFiles(x86)%\Google\Chrome\Application\chrome.exe'),
            os.path.expandvars(r'%LocalAppData%\Google\Chrome\Application\chrome.exe'),
            os.path.expandvars(r'%ProgramFiles%\Chromium\Application\chrome.exe'),
            os.path.expandvars(r'%ProgramFiles(x86)%\Chromium\Application\chrome.exe'),
        ]
        for p in paths:
            v, raw = get_windows_file_version(p)
            if v:
                findings.append((p, v, raw))
    else:
        candidates = [
            'google-chrome', 'google-chrome-stable', 'chromium', 'chromium-browser',
            '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
            '/Applications/Chromium.app/Contents/MacOS/Chromium',
            '/usr/bin/google-chrome', '/usr/bin/google-chrome-stable',
            '/usr/bin/chromium', '/usr/bin/chromium-browser',
            '/snap/bin/chromium'
        ]
        seen = set()
        for c in candidates:
            target = shutil.which(c) if not c.startswith('/') else (c if os.path.exists(c) else None)
            if not target or target in seen:
                continue
            seen.add(target)
            v, raw = get_version_from_command([target, '--version'])
            if v:
                findings.append((target, v, raw))

    return findings


def main():
    findings = collect_versions()
    if not findings:
        print('UNKNOWN - Could not identify a local Chrome/Chromium installation or parse its version.')
        sys.exit(2)

    vulnerable = []
    patched = []
    for path, version, raw in findings:
        if version_is_patched(version):
            patched.append((path, version))
        else:
            vulnerable.append((path, version))

    if vulnerable:
        details = ', '.join([f'{p}={".".join(map(str, v))}' for p, v in vulnerable])
        print(f'VULNERABLE - Found Chrome/Chromium versions below 149.0.7827.53: {details}')
        sys.exit(1)

    details = ', '.join([f'{p}={".".join(map(str, v))}' for p, v in patched])
    print(f'PATCHED - All detected Chrome/Chromium installations are at or above 149.0.7827.53: {details}')
    sys.exit(0)


if __name__ == '__main__':
    main()

Sources

1. Google Chrome Releases - Stable Channel Update for Desktop (Chrome 149)
2. Google Chrome Releases - Early Stable Update for Desktop
3. Google Chrome Releases - Chrome Beta for Desktop Update
4. CISA Known Exploited Vulnerabilities Catalog
5. FIRST EPSS overview
6. FIRST EPSS API documentation
7. openSUSE Chromium patchinfo for 149.0.7827.53 security fixes
8. Canadian Centre for Cyber Security advisory for Chrome 149.0.7827.53/54