Inappropriate implementation in PDF in Google Chrome prior to 149

CVE-2026-11261 is an inappropriate implementation flaw in Chrome's PDF handling. It affects Google Chrome before 149.0.7827.53; public advisories for the June 2026 release frame the fixed builds as 149.0.7827.53 for Linux and 149.0.7827.53/54 for Windows and macOS. The key phrase in the description is the one that matters operationally: the attacker must have already compromised the renderer process before this bug becomes useful.

Google's MEDIUM 4.3 is technically fair in a vacuum, but for enterprise patch triage I'd still downgrade it to LOW because the exploit chain starts after the attacker already landed a separate renderer exploit or equivalent code-exec-in-renderer condition. That prerequisite crushes the reachable population and makes this a chain-hardener issue rather than a standalone mass-exploitation risk. Chrome is everywhere, yes, but this bug is not the thing that gets attackers in the door.

Why this verdict

• Requires prior renderer compromise: this is the whole case. A bug that only helps after the attacker already owns the renderer is post-initial-access by definition, so I cut the score below the vendor's generic browser medium baseline.
• Reachable population is narrower than 'all Chrome users': not every browsing session loads attacker-controlled PDFs through the built-in viewer, and many enterprise users never hit this path from untrusted origins.
• No exploitation pressure: no KEV, no public active-campaign reporting, and a near-zero EPSS mean attackers are not signaling broad operational interest.
• Impact is modest on paper: the provided vector is Integrity: Low only. If this were an observed sandbox escape or reliable code-exec primitive, the score would rise fast; the published metadata does not support that.

Why not higher?

Because the exploit chain assumes a major earlier win by the attacker: compromising Chrome's renderer. That prerequisite implies a separate bug, separate reliability burden, and a much smaller real-world target set than the raw 'remote browser vulnerability' label suggests. Also, the disclosed impact is not full RCE, not credential theft, and not a known in-the-wild escape chain.

Why not lower?

I did not drop this to IGNORE because second-stage browser bugs still matter in mature exploit chains, especially in a product as ubiquitous as Chrome. If you operate high-risk user populations, even low-severity browser chain components deserve inventory visibility and normal-version hygiene.

1. Enforce Chrome auto-update — Make sure enterprise policy does not strand endpoints on frozen browser versions. For a LOW verdict there is no SLA; treat this as backlog hygiene and verify auto-update coverage during your normal endpoint maintenance cycle.
2. Inventory stale browser channels — Find hosts pinned below 149.0.7827.53 or disconnected from update services. For a LOW verdict there is no SLA; sweep these into your routine workstation/browser currency program rather than emergency change windows.
3. Reduce untrusted PDF rendering where practical — If your environment can tolerate it, route risky PDFs to isolated viewers, download-only flows, or hardened virtual browsing paths. For a LOW verdict there is no SLA; use this as a structural hardening opportunity, not a fire drill.
4. Watch browser exploit telemetry — Track EDR alerts, browser crash spikes, exploit mitigation events, and anomalous renderer or utility-process behavior. This matters because if a separate renderer exploit appears, bugs like this become better chain fuel.

Run this on the target endpoint or through your software-distribution / EDR live-response channel. Invoke it with python3 check_chrome_cve_2026_11261.py on Linux/macOS or py check_chrome_cve_2026_11261.py on Windows; standard user rights are usually enough because it only reads local version metadata and common install paths.

#!/usr/bin/env python3
# check_chrome_cve_2026_11261.py
# Determine whether local Google Chrome is vulnerable to CVE-2026-11261
# Affected: versions prior to 149.0.7827.53
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import subprocess
import sys

TARGET = (149, 0, 7827, 53)


def norm_version_tuple(s):
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', s)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def run_cmd(cmd):
    try:
        p = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, timeout=10)
        out = (p.stdout or '') + (p.stderr or '')
        return out.strip()
    except Exception:
        return ''


def get_version_windows():
    cmds = [
        ['reg', 'query', r'HKLM\Software\Google\Chrome\BLBeacon', '/v', 'version'],
        ['reg', 'query', r'HKLM\Software\WOW6432Node\Google\Chrome\BLBeacon', '/v', 'version'],
        ['reg', 'query', r'HKCU\Software\Google\Chrome\BLBeacon', '/v', 'version'],
        ['powershell', '-NoProfile', '-Command', r"(Get-Item 'C:\Program Files\Google\Chrome\Application\chrome.exe').VersionInfo.ProductVersion"],
        ['powershell', '-NoProfile', '-Command', r"(Get-Item 'C:\Program Files (x86)\Google\Chrome\Application\chrome.exe').VersionInfo.ProductVersion"]
    ]
    for cmd in cmds:
        out = run_cmd(cmd)
        v = norm_version_tuple(out)
        if v:
            return v, '.'.join(map(str, v))
    return None, None


def get_version_macos():
    paths = [
        '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
        os.path.expanduser('~/Applications/Google Chrome.app/Contents/MacOS/Google Chrome')
    ]
    for p in paths:
        if os.path.exists(p):
            out = run_cmd([p, '--version'])
            v = norm_version_tuple(out)
            if v:
                return v, '.'.join(map(str, v))
    plist = '/Applications/Google Chrome.app/Contents/Info.plist'
    if os.path.exists(plist):
        out = run_cmd(['/usr/bin/defaults', 'read', plist, 'KSVersion'])
        v = norm_version_tuple(out)
        if v:
            return v, '.'.join(map(str, v))
    return None, None


def get_version_linux():
    cmds = [
        ['google-chrome', '--version'],
        ['google-chrome-stable', '--version'],
        ['/opt/google/chrome/chrome', '--version'],
        ['/usr/bin/google-chrome', '--version'],
        ['/usr/bin/google-chrome-stable', '--version']
    ]
    for cmd in cmds:
        out = run_cmd(cmd)
        v = norm_version_tuple(out)
        if v:
            return v, '.'.join(map(str, v))
    return None, None


def main():
    system = platform.system().lower()
    if 'windows' in system:
        v, raw = get_version_windows()
    elif 'darwin' in system:
        v, raw = get_version_macos()
    else:
        v, raw = get_version_linux()

    if not v:
        print('UNKNOWN - Google Chrome not found or version could not be determined')
        sys.exit(2)

    if v < TARGET:
        print(f'VULNERABLE - Chrome version {raw} is below 149.0.7827.53')
        sys.exit(1)
    else:
        print(f'PATCHED - Chrome version {raw} is 149.0.7827.53 or later')
        sys.exit(0)


if __name__ == '__main__':
    main()

Sources

1. Google Chrome Releases - Early Stable Update for Desktop
2. Canadian Centre for Cyber Security AV26-544
3. GovCERT.HK Chrome security alert
4. Chromium multi-process architecture
5. Chromium sandbox diagnostics for Windows
6. CISA Known Exploited Vulnerabilities Catalog
7. FIRST EPSS API documentation
8. FIRST EPSS query for CVE-2026-11261