Inappropriate implementation in Cast in Google Chrome prior to 149

CVE-2026-11276 is a Cast implementation flaw in Google Chrome that affects desktop builds prior to 149.0.7827.53 on Linux and prior to 149.0.7827.53/54 on Windows and macOS. The bug lets an attacker on the *same local network segment* send malicious network traffic and bypass discretionary access control in the Cast path, which translates to unauthorized access to some Cast-related action or state rather than full browser compromise.

Google's MEDIUM 5.1 label is defensible in a vacuum, but it is too generous for most enterprise fleets. The decisive friction is attacker position: this is not internet-reachable and not webpage-triggered, it needs local adjacency on the same LAN/Wi-Fi segment and a reachable Cast surface, which makes it a post-initial-access or insider-style issue with limited blast radius and only low confidentiality/integrity impact.

Why this verdict

• Adjacent-network prerequisite cuts the population hard: the attacker must be on the same local segment, which in enterprise terms usually means post-initial-access, insider presence, or shared Wi-Fi adjacency; that is a material downgrade from any remotely deliverable browser bug.
• Feature reachability is narrower than Chrome install base: Chrome is everywhere, but reachable Cast attack surface is not. Enterprises commonly disable casting, suppress local discovery, or simply never use it on managed endpoints.
• Threat intel is quiet: no KEV, no public exploitation evidence, no public PoC found, and EPSS is essentially at the floor. That is strong downward pressure from the vendor's 5.1 baseline.

Why not higher?

This is not a drive-by web exploit, not internet-reachable, and not an RCE. The attack path assumes local adjacency plus a Cast-relevant target state, and the resulting impact is only low confidentiality/integrity loss with no availability impact.

Why not lower?

It is still a real access-control bypass in a product deployed at huge scale, and local-segment exposure is not hypothetical in campuses, shared offices, labs, and guest/corp Wi-Fi mistakes. If you have unmanaged nearby devices, poor client isolation, or active Cast usage, the bug is worth fixing even if it should not outrank remotely weaponizable Chrome flaws.

1. Disable Cast where unused — Use Chrome enterprise policy to remove or restrict Cast on managed endpoints that do not need it. This directly shrinks the reachable attack surface and, for a LOW verdict, should be handled as backlog hygiene with no formal mitigation SLA unless you know you have exposed shared-network use cases.
2. Enforce client isolation on guest and shared Wi-Fi — Turn on peer isolation and keep guest wireless off corp trust zones so adjacent clients cannot directly reach each other. This is the best architectural control for the bug's only realistic attack path and should be folded into normal network-hardening work, again with no formal mitigation SLA for this severity.
3. Constrain local discovery traffic — Filter or limit mDNS/SSDP-style east-west discovery where it is not business-required. That reduces discovery and exploit reliability for Cast-adjacent abuse and is especially useful in conference rooms, labs, and shared floors.
4. Keep managed Chrome on stable or Extended Stable auto-update — This bug is best neutralized by version hygiene, not detective controls. Ensure endpoints actually consume Stable 149.0.7827.53/54 or Windows/macOS Extended Stable 148.0.7778.254 through your normal browser update rings.

Run this on the target endpoint itself, or push it through your RMM/SCCM/Jamf/Intune script runner. Invoke it as python3 check_chrome_cve_2026_11276.py on macOS/Linux or py check_chrome_cve_2026_11276.py on Windows; no administrator rights are normally required because it only reads the installed browser version.

#!/usr/bin/env python3
# check_chrome_cve_2026_11276.py
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN

import os
import platform
import re
import subprocess
import sys
from shutil import which

FIX_STABLE = (149, 0, 7827, 53)
FIX_EXTENDED = (148, 0, 7778, 254)  # Windows/macOS Extended Stable includes the security fixes


def parse_version(text):
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def run_version(cmd):
    try:
        p = subprocess.run(cmd, capture_output=True, text=True, timeout=5)
        out = (p.stdout or '') + ' ' + (p.stderr or '')
        return out.strip()
    except Exception:
        return ''


def candidate_commands():
    system = platform.system().lower()
    cmds = []

    if system == 'windows':
        for path in [
            os.path.expandvars(r'%ProgramFiles%\Google\Chrome\Application\chrome.exe'),
            os.path.expandvars(r'%ProgramFiles(x86)%\Google\Chrome\Application\chrome.exe'),
            os.path.expandvars(r'%LocalAppData%\Google\Chrome\Application\chrome.exe'),
        ]:
            if path and os.path.exists(path):
                cmds.append([path, '--version'])
    elif system == 'darwin':
        path = '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'
        if os.path.exists(path):
            cmds.append([path, '--version'])
    else:
        for name in ['google-chrome', 'google-chrome-stable', 'chromium-browser', 'chromium']:
            p = which(name)
            if p:
                cmds.append([p, '--version'])

    return cmds


def is_patched(version, system_name):
    # Stable fix for all platforms
    if version >= FIX_STABLE:
        return True

    # Windows/macOS Extended Stable path
    if system_name in ('windows', 'darwin'):
        if version[0:3] == FIX_EXTENDED[0:3] and version >= FIX_EXTENDED:
            return True

    return False


def is_potentially_vulnerable(version, system_name):
    # Any 149 build below stable fix is vulnerable
    if version[0:3] == FIX_STABLE[0:3] and version < FIX_STABLE:
        return True

    # Earlier majors are vulnerable unless they are the known Extended Stable fixed train on Win/macOS
    if version[0] < 149:
        if system_name in ('windows', 'darwin') and version[0:3] == FIX_EXTENDED[0:3] and version >= FIX_EXTENDED:
            return False
        return True

    return False


def main():
    system_name = platform.system().lower()
    cmds = candidate_commands()

    if not cmds:
        print('UNKNOWN - Google Chrome executable not found')
        sys.exit(2)

    seen = []
    for cmd in cmds:
        output = run_version(cmd)
        version = parse_version(output)
        if version:
            seen.append((cmd[0], version, output))

    if not seen:
        print('UNKNOWN - Could not determine installed Chrome version')
        sys.exit(2)

    # Prefer the highest version found if multiple copies exist
    seen.sort(key=lambda x: x[1], reverse=True)
    path, version, raw = seen[0]

    if is_patched(version, system_name):
        print(f'PATCHED - {path} -> {raw}')
        sys.exit(0)

    if is_potentially_vulnerable(version, system_name):
        print(f'VULNERABLE - {path} -> {raw}')
        sys.exit(1)

    print(f'UNKNOWN - {path} -> {raw} (version not mapped cleanly to stable or extended-stable fix trains)')
    sys.exit(2)


if __name__ == '__main__':
    main()

Sources

1. Google Chrome Releases - Stable Channel Update for Desktop
2. Google Chrome Releases - Extended Stable Updates for Desktop
3. Canadian Centre for Cyber Security - Google Chrome security advisory AV26-544
4. SUSE CVE page for CVE-2026-11276
5. openSUSE patchinfo including CVE-2026-11276
6. FIRST EPSS data and statistics
7. CISA Known Exploited Vulnerabilities Catalog
8. Chromium Security