Insufficient policy enforcement in Extensions in Google Chrome prior to 149

CVE-2026-11267 is an insufficient policy enforcement flaw in Chrome Extensions affecting Google Chrome before 149.0.7827.53. Based on the Chromium fix that blocks message connections from sandboxed extension pages, the practical issue is that a malicious extension could abuse an extension-internal trust boundary and reach messaging or privileged flows it should not have reached. The affected desktop builds were fixed in 149.0.7827.53 for Linux and 149.0.7827.53/.54 for Windows and macOS.

Google's MEDIUM 4.3 label is already restrained, and in enterprise reality it still trends down, not up. The decisive friction is that the attacker does not get this from a random website alone; they need the victim to install a malicious extension first, which is a separate social-engineering or policy-control failure. That makes this a post-user-action browser hardening issue with narrow real-world reach, not a broad remote compromise bug.

Why this verdict

• Requires a malicious extension first: the attacker is not just sending packets at Chrome; they must land a hostile extension, which implies prior social engineering, unmanaged installs, or weak admin policy
• Reachable population collapses fast in managed fleets: enterprises using ExtensionSettings, allowlists, or force-install-only models remove most of the practical attack surface
• Impact is modest even on success: the published CVSS is integrity-only and user-interaction-dependent, with no stated confidentiality or availability impact and no evidence of host-level takeover
• No exploitation pressure: no KEV listing, no public campaign evidence, and a near-zero EPSS keep this out of urgent patch-now territory

Why not higher?

A higher rating would require either broad pre-auth remote reach, active exploitation, or a blast radius that extends beyond the browser extension boundary. None of those are present here. Every meaningful path starts with a malicious extension install, which is exactly the kind of compounding prerequisite that should drag severity down for enterprise prioritization.

Why not lower?

This is still a real security boundary failure in one of the most widely deployed enterprise applications on the planet. If your environment allows permissive extension installs, the social-engineering hurdle is not hypothetical, and a malicious extension gaining extra reach is worth fixing rather than ignoring.

1. Allowlist extensions only — Use Chrome Enterprise ExtensionSettings or Admin Console allow/block mode so users can install only approved extensions. For a LOW verdict there is no mitigation SLA; treat this as policy hygiene and fold it into your next browser-governance review rather than an emergency change.
2. Block risky extension permissions — Use Chrome app/extension policy controls to block permissions your org does not need, especially broad webpage access and sensitive capabilities. This shrinks post-install blast radius even if a bad extension slips through; again, no mitigation SLA applies here, so do it in the normal hardening cycle.
3. Inventory installed extensions — Pull the Chrome Apps & Extensions usage report and identify user-installed extensions, especially anything not force-installed by IT. This is the fastest way to find where the prerequisite for this CVE actually exists in your fleet.
4. Restrict unmanaged browsers — The real exposure lives in unmanaged Chrome instances where users can self-install extensions. Push devices into Chrome management or enforce enterprise browser policy so the extension gate is closed by default.

Run this on the target endpoint or through your endpoint management tooling. Invoke it with python3 check_chrome_cve_2026_11267.py; it needs only normal user rights and checks common Chrome install locations on Windows, macOS, and Linux. It reports VULNERABLE, PATCHED, or UNKNOWN based on whether the detected Chrome version is before 149.0.7827.53.

#!/usr/bin/env python3
# check_chrome_cve_2026_11267.py
# Detect exposure to CVE-2026-11267 by checking local Google Chrome version.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import subprocess
import sys
from shutil import which

THRESHOLD = (149, 0, 7827, 53)


def parse_version(text):
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text or '')
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def run_cmd(cmd):
    try:
        p = subprocess.run(cmd, capture_output=True, text=True, timeout=10)
        out = (p.stdout or '') + '\n' + (p.stderr or '')
        return out.strip()
    except Exception:
        return ''


def get_windows_version():
    candidates = [
        os.path.join(os.environ.get('ProgramFiles', r'C:\Program Files'), 'Google', 'Chrome', 'Application', 'chrome.exe'),
        os.path.join(os.environ.get('ProgramFiles(x86)', r'C:\Program Files (x86)'), 'Google', 'Chrome', 'Application', 'chrome.exe'),
        os.path.join(os.environ.get('LOCALAPPDATA', ''), 'Google', 'Chrome', 'Application', 'chrome.exe'),
    ]
    for path in candidates:
        if path and os.path.exists(path):
            cmd = [
                'powershell', '-NoProfile', '-Command',
                f"(Get-Item '{path.replace("'", "''")}').VersionInfo.ProductVersion"
            ]
            out = run_cmd(cmd)
            ver = parse_version(out)
            if ver:
                return ver, path
    return None, None


def get_macos_version():
    candidates = [
        '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
        os.path.expanduser('~/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'),
    ]
    for path in candidates:
        if os.path.exists(path):
            out = run_cmd([path, '--version'])
            ver = parse_version(out)
            if ver:
                return ver, path
    return None, None


def get_linux_version():
    bins = ['google-chrome', 'google-chrome-stable', 'chrome', 'chromium', 'chromium-browser']
    for b in bins:
        exe = which(b)
        if exe:
            out = run_cmd([exe, '--version'])
            ver = parse_version(out)
            if ver:
                return ver, exe
    return None, None


def main():
    system = platform.system().lower()
    version = None
    source = None

    if 'windows' in system:
        version, source = get_windows_version()
    elif 'darwin' in system:
        version, source = get_macos_version()
    elif 'linux' in system:
        version, source = get_linux_version()
    else:
        print('UNKNOWN - Unsupported OS')
        sys.exit(2)

    if not version:
        print('UNKNOWN - Google Chrome not found or version unreadable')
        sys.exit(2)

    version_str = '.'.join(str(x) for x in version)
    threshold_str = '.'.join(str(x) for x in THRESHOLD)

    if version < THRESHOLD:
        print(f'VULNERABLE - Detected Chrome {version_str} at {source}; fixed version is {threshold_str} or later')
        sys.exit(1)
    else:
        print(f'PATCHED - Detected Chrome {version_str} at {source}; meets fixed version threshold {threshold_str}')
        sys.exit(0)


if __name__ == '__main__':
    main()

Sources

1. Chrome Releases: Early Stable Update for Desktop
2. Chromium 149 branch log
3. Canadian Centre for Cyber Security advisory AV26-544
4. Chrome Enterprise: Allow or block apps and extensions
5. Chrome Enterprise: View app and extension usage details
6. Chrome Enterprise: Set Chrome app and extension policies (Windows)
7. Google Online Security Blog: Staying Safe with Chrome Extensions
8. CISA Known Exploited Vulnerabilities Catalog