Integer overflow in Chromoting in Google Chrome on Windows prior to 149

CVE-2026-11281 is an integer overflow in the Chromoting code path of Google Chrome on Windows affecting versions prior to 149.0.7827.53. The public description says a local attacker can use a crafted ETW event to leak potentially sensitive data from process memory. That means the bug is about information disclosure, not direct code execution, and the attacker already needs a foothold on the endpoint with at least low privileges.

The vendor's MEDIUM 5.0 baseline is defensible in a vacuum, but it overstates operational urgency for most enterprises. The attack chain is heavily gated by local access, valid privileges, and a likely narrow Windows/Chromoting/ETW reachability path; those are classic post-compromise friction points. For a team managing 10,000 hosts, this is patch-worthy but not a front-of-queue event unless you are already dealing with endpoint compromise or have a special dependency on Chrome Remote Desktop/Chromoting features.

Why this verdict

• Requires local foothold first — AV:L/PR:L/UI:R means the attacker is already on the box. That implies a prior compromise stage and sharply cuts the exposed population versus remotely triggerable Chrome bugs.
• Confidentiality-only impact — the published impact is memory disclosure, not code execution or sandbox escape. Useful, yes, but usually as a follow-on primitive rather than the main event.
• Likely narrow code-path reachability — exploitation depends on a crafted ETW event hitting a Chromoting-related path on Windows. Specialized local instrumentation paths see far less real-world abuse than generic webpage-driven browser surfaces.

Why not higher?

This is not a network-reachable browser RCE, not a renderer-to-sandbox-escape chain, and not a zero-click drive-by. The attacker needs local execution, some privileges, and a specialized ETW-trigger path before any data can leak. That combination is exactly why it should not sit in the same patch queue as remotely exploitable Chrome memory-corruption bugs.

Why not lower?

It is still a real memory disclosure bug in a widely deployed enterprise application, and post-compromise info leaks can materially help credential theft, token recovery, or exploit chaining. If you already have endpoint compromise, this kind of bug can make containment worse, so 'IGNORE' would be too dismissive.

1. Prioritize endpoints already under incident response — If you have suspected or confirmed Windows endpoint compromise, move vulnerable Chrome builds on those systems to the front of your containment-and-recovery backlog. For a LOW noisgate verdict there is no formal mitigation SLA, but incident-impacted hosts should not wait for the normal browser ring.
2. Tighten local execution controls — Enforce or validate WDAC/AppLocker/ASR/EDR preventions that stop arbitrary user-mode tooling from gaining a foothold or abusing local tracing APIs. This matters more than the CVE itself because the attacker must already be local; for LOW, treat this as backlog hygiene unless an active compromise is in play.
3. Use version-based scoping — Pull a Chrome version inventory from your endpoint platform or Chrome Enterprise versions report and isolate Windows systems below 149.0.7827.53. For LOW, there is no separate mitigation clock; use this to feed the normal patch wave and exception tracking.
4. Restrict unnecessary Chrome Remote Desktop usage — Where Chromoting or Chrome Remote Desktop is not needed, remove it from sensitive admin workstations and jump hosts to reduce attack surface. This is an exposure-reduction measure, not an emergency control, so apply it through standard workstation hardening change windows.

Run this on the target Windows endpoint itself, or push it through SCCM, Intune, PDQ, Tanium, or your RMM. Invoke with powershell -ExecutionPolicy Bypass -File .\check-chrome-cve-2026-11281.ps1; standard user rights are usually enough because it only reads file and registry version data.

# check-chrome-cve-2026-11281.ps1

# Detect whether Google Chrome on Windows is older than 149.0.7827.53

# Output: VULNERABLE / PATCHED / UNKNOWN

# Exit codes: 1 = VULNERABLE, 0 = PATCHED, 2 = UNKNOWN


$ErrorActionPreference = 'SilentlyContinue'

function Get-ChromeVersion {
    $candidates = @(
        'C:\Program Files\Google\Chrome\Application\chrome.exe',
        'C:\Program Files (x86)\Google\Chrome\Application\chrome.exe',
        "$env:LOCALAPPDATA\Google\Chrome\Application\chrome.exe"
    )

    foreach ($path in $candidates) {
        if (Test-Path $path) {
            try {
                $ver = (Get-Item $path).VersionInfo.ProductVersion
                if ($ver) { return $ver }
            } catch {}
        }
    }

    $regPaths = @(
        'HKLM:\SOFTWARE\Google\Chrome\BLBeacon',
        'HKLM:\SOFTWARE\WOW6432Node\Google\Chrome\BLBeacon',
        'HKCU:\SOFTWARE\Google\Chrome\BLBeacon'
    )

    foreach ($reg in $regPaths) {
        try {
            $ver = (Get-ItemProperty -Path $reg -Name version).version
            if ($ver) { return $ver }
        } catch {}
    }

    return $null
}

if (-not $IsWindows) {
    Write-Output 'UNKNOWN: This check is intended for Windows only.'
    exit 2
}

$fixed = [version]'149.0.7827.53'
$rawVersion = Get-ChromeVersion

if (-not $rawVersion) {
    Write-Output 'UNKNOWN: Google Chrome not found or version unreadable.'
    exit 2
}

try {
    $installed = [version]$rawVersion
} catch {
    Write-Output "UNKNOWN: Unparseable Chrome version '$rawVersion'."
    exit 2
}

if ($installed -lt $fixed) {
    $chromotingSvc = Get-Service -Name 'chromoting' -ErrorAction SilentlyContinue
    if ($chromotingSvc) {
        Write-Output "VULNERABLE: Chrome $installed is older than $fixed. Chromoting service present: $($chromotingSvc.Status)."
    } else {
        Write-Output "VULNERABLE: Chrome $installed is older than $fixed. Chromoting service not detected."
    }
    exit 1
} else {
    $chromotingSvc = Get-Service -Name 'chromoting' -ErrorAction SilentlyContinue
    if ($chromotingSvc) {
        Write-Output "PATCHED: Chrome $installed is at or above $fixed. Chromoting service present: $($chromotingSvc.Status)."
    } else {
        Write-Output "PATCHED: Chrome $installed is at or above $fixed."
    }
    exit 0
}

Sources

1. Chrome Releases: Early Stable Update for Desktop (149.0.7827.53/.54)
2. CVE Alert feed entry referencing CVE-2026-11281
3. Chromium elevated tracing service README
4. Microsoft Learn: Instrumenting Your Code with ETW
5. FIRST EPSS program
6. FIRST EPSS data statistics
7. CISA Known Exploited Vulnerabilities Catalog
8. Google Chrome Enterprise: View Chrome version details