Uninitialized Use in ANGLE in Google Chrome on Windows prior to 149

CVE-2026-11268 is an uninitialized use bug in ANGLE on Google Chrome for Windows that affects builds prior to 149.0.7827.53. The attacker’s play is simple: get a user onto a crafted HTML page, exercise the browser’s graphics stack, and recover cross-origin data that should have stayed isolated. This is a confidentiality bug, not code execution, and the platform scope matters: the published description is Windows-specific.

Google’s MEDIUM / 6.5 rating is basically fair in enterprise reality. Chrome is everywhere, which keeps the baseline meaningful, but the chain has real friction: it needs user interaction, it is client-side, it appears limited to information disclosure, and there is no KEV listing, no public exploitation evidence, and no public PoC at time of review. That keeps it out of the emergency lane unless you run highly sensitive browser sessions on Windows endpoints.

Why this verdict

• Baseline starts at 6.5: Google/NVD already price in the serious part correctly — unauthenticated remote web content can cause cross-origin data disclosure.
• Downward pressure: requires user interaction: the attacker must get a Windows user to open attacker-controlled content. That moves this from 'internet-reachable service bug' to 'lure-dependent client exploit'.
• Downward pressure: no foothold creation: this is C:H / I:N / A:N. It can leak sensitive data, but it does not by itself hand over code execution or persistence on the endpoint.
• Downward pressure: Windows-only scope: affected population is narrower than 'all Chrome everywhere', which matters in mixed OS fleets.
• Downward pressure: no exploitation signal: no KEV, no public campaign reporting, no public PoC. That sharply reduces the odds of near-term broad weaponization versus higher-noise browser memory bugs.
• Upward pressure: browser ubiquity and identity risk: if the victim is browsing high-value SaaS, a confidentiality-only bug can still expose session-adjacent material with real business impact.

Why not higher?

It is not higher because the chain lacks the two usual amplifiers that justify urgent browser work: active exploitation or code execution / sandbox escape. The attacker still has to win a lure, hit the right browser/runtime state, and extract useful cross-origin artifacts rather than simply take over the box.

Why not lower?

It is not lower because cross-origin data leakage in a modern enterprise browser is still meaningful, especially around SSO, admin consoles, and internal web apps. Chrome is broadly deployed, and even a confidentiality-only client bug can produce real account and data exposure when it lands on a privileged user.

1. Enforce Chrome version compliance — Use your browser management platform, EDR, or software inventory to find Windows Chrome < 149.0.7827.53 and ring-fence stragglers. For a MEDIUM verdict there is no mitigation SLA — go straight to the 365-day remediation window, but in practice browsers should be cleaned up in normal desktop update cadence, not left to rot.
2. Prioritize high-value browsing populations — Move admins, finance users, executives, help-desk staff, and VDI/kiosk pools to the front of the rollout because their browser sessions are more likely to hold valuable cross-origin material. Again, there is no mitigation SLA for MEDIUM here; this is targeted risk reduction while patching proceeds.
3. Tighten web isolation for risky destinations — If you already run browser isolation, remote browsing, or strong category-based filtering for unknown sites, make sure it is actually applied to unmanaged and newly registered domains. This does not replace patching, but it reduces the chance the required lure step succeeds while you work through the remediation window.
4. Watch SaaS logs for token misuse — Because the likely impact is data or session-adjacent theft, monitor suspicious logins, impossible travel, fresh device enrollments, and token reuse for high-risk apps. This is the right detective control for a confidentiality bug; there is no mitigation SLA to hit first for MEDIUM.

Run this on the target Windows endpoint or through your software deployment/EDR remote shell. Invoke it as powershell -ExecutionPolicy Bypass -File .\check-chrome-cve-2026-11268.ps1; standard user rights are usually enough because it reads file metadata and common install paths. It prints VULNERABLE, PATCHED, or UNKNOWN and exits 1, 0, or 2 respectively.

# check-chrome-cve-2026-11268.ps1

# Checks whether Google Chrome on Windows is vulnerable to CVE-2026-11268

# Vulnerable if installed version is less than 149.0.7827.53

# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN


$ErrorActionPreference = 'Stop'
$patchedFloor = [version]'149.0.7827.53'

function Get-ChromeVersion {
    $candidates = @(
        "$Env:ProgramFiles\Google\Chrome\Application\chrome.exe",
        "$Env:ProgramFiles(x86)\Google\Chrome\Application\chrome.exe",
        "$Env:LocalAppData\Google\Chrome\Application\chrome.exe"
    )

    foreach ($path in $candidates) {
        if (Test-Path $path) {
            try {
                $item = Get-Item $path
                $ver = $item.VersionInfo.ProductVersion
                if (-not [string]::IsNullOrWhiteSpace($ver)) {
                    return [PSCustomObject]@{ Path = $path; Version = $ver }
                }
            } catch {
                continue
            }
        }
    }

    return $null
}

try {
    $chrome = Get-ChromeVersion

    if ($null -eq $chrome) {
        Write-Output 'UNKNOWN - Google Chrome not found in standard install paths'
        exit 2
    }

    try {
        $installed = [version]$chrome.Version
    } catch {
        Write-Output ("UNKNOWN - Unable to parse Chrome version '{0}' at {1}" -f $chrome.Version, $chrome.Path)
        exit 2
    }

    if ($installed -lt $patchedFloor) {
        Write-Output ("VULNERABLE - Chrome {0} at {1} is earlier than fixed version {2}" -f $installed, $chrome.Path, $patchedFloor)
        exit 1
    } else {
        Write-Output ("PATCHED - Chrome {0} at {1} meets or exceeds fixed version {2}" -f $installed, $chrome.Path, $patchedFloor)
        exit 0
    }
} catch {
    Write-Output ('UNKNOWN - ' + $_.Exception.Message)
    exit 2
}

Sources

1. Google Chrome Stable Channel Update for Desktop (June 2, 2026)
2. Chromium issue 500528706
3. Quanteta CVE-2026-11268 record
4. Canadian Centre for Cyber Security advisory AV26-544
5. CISA Known Exploited Vulnerabilities Catalog
6. GreyNoise Intelligence
7. Censys Search product page