Insufficient policy enforcement in Sandbox in Google Chrome on Linux prior to 149

CVE-2026-11282 is a Linux-only Google Chrome sandbox policy enforcement flaw affecting versions prior to 149.0.7827.53. A malicious site can potentially abuse the browser's Linux sandbox handling via crafted HTML so code or actions that should stay trapped in the renderer may break containment and reach beyond the intended browser isolation boundary.

The 9.6/CRITICAL label overstates enterprise reality. This is still a real browser boundary failure, but it is client-side, user-interaction-driven, Linux-only, not internet-scannable, and currently lacks KEV listing, public PoC, or observed exploitation evidence; those are major downward pressures compared with a remotely reachable server bug.

Why this verdict

• [object Object]
• Downgrade for attacker position: exploitation starts from a malicious web page with user interaction, not unauthenticated remote access to a service. That immediately removes the 'scan once, hit thousands of hosts' economics that justify many critical scores.
• Downgrade for population reach: the vulnerable set is Linux Chrome only. In most enterprises, that implies a narrower and more specialized workstation population than general desktop browser exposure.
• Downgrade for threat intel weakness: no KEV listing, no public PoC, and EPSS 0.00089 mean there is no current sign this is being operationalized at scale.
• Hold at MEDIUM, not LOW: this is still a sandbox escape, which attacks one of Chrome's core containment layers. On high-value Linux admin/dev workstations, a browser boundary break can expose tokens, source, secrets, and follow-on access.

Why not higher?

A higher rating would require a stronger amplifier such as active exploitation, a public weaponized PoC, cross-platform reach, or server-side exposure. None of those are present in the retrieved sources, and the client-side Linux-only deployment reality cuts hard against a CRITICAL/HIGH response.

Why not lower?

A lower rating would ignore that sandbox escapes are strategically valuable even when they are not yet hot in the wild. This is also a remote trigger via web content, so affected Linux workstations that browse untrusted content are exposed without any prior local foothold.

1. Verify browser auto-update works — Make sure Linux Chrome endpoints can actually reach Google's update channels and are not pinned below 149.0.7827.53. Because this is a MEDIUM verdict, there is no noisgate mitigation SLA; use this as a low-friction control while you work inside the 365-day remediation window.
2. Separate privileged browsing from admin workstations — Keep routine web browsing off Linux systems that hold production credentials, cloud admin sessions, signing keys, or source secrets. There is no noisgate mitigation SLA for MEDIUM issues, but reducing the value of the target host is still worth doing immediately where feasible.
3. Enforce URL filtering and Safe Browsing — This bug needs the user to reach attacker-controlled content, so web filtering, DNS controls, and Chrome's phishing protections are directly relevant. With a MEDIUM verdict there is no mitigation SLA — go straight to the 365-day remediation window, but keep these controls healthy because they cut the initial prerequisite.
4. Harden Linux endpoint isolation — Use SELinux/AppArmor, least-privilege local accounts, and EDR policies that flag Chrome spawning shells or touching sensitive paths. These controls do not fix the bug, but they can reduce what a post-sandbox attacker can do while patching proceeds inside the 365-day remediation window.

Run this on the target Linux endpoint or through your fleet agent. Invoke it as bash check-chrome-cve-2026-11282.sh; no root is required, but root helps if you want package-manager fallback checks to see system packages consistently.

#!/usr/bin/env bash
# check-chrome-cve-2026-11282.sh
# Determine whether Google Chrome on Linux is vulnerable to CVE-2026-11282
# Vulnerable: versions prior to 149.0.7827.53
# Outputs exactly one of: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u
FIXED="149.0.7827.53"

ver_lt() {
  # returns 0 if $1 < $2
  [ "$(printf '%s\n%s\n' "$1" "$2" | sort -V | head -n1)" != "$2" ] && return 1
  [ "$1" = "$2" ] && return 1
  return 0
}

extract_version() {
  # Pull first dotted version token from input
  sed -nE 's/.* ([0-9]+(\.[0-9]+){2,}).*/\1/p' | head -n1
}

chrome_version=""
source_note=""

for bin in google-chrome-stable google-chrome /opt/google/chrome/google-chrome; do
  if command -v "$bin" >/dev/null 2>&1; then
    chrome_version="$($bin --version 2>/dev/null | extract_version)"
    source_note="$bin"
    break
  fi
  if [ -x "$bin" ]; then
    chrome_version="$($bin --version 2>/dev/null | extract_version)"
    source_note="$bin"
    break
  fi
done

# Package-manager fallback for Google Chrome only
if [ -z "$chrome_version" ]; then
  if command -v dpkg-query >/dev/null 2>&1; then
    chrome_version="$(dpkg-query -W -f='${Version}\n' google-chrome-stable 2>/dev/null | sed 's/-.*//' | head -n1)"
    if [ -n "$chrome_version" ]; then
      source_note="dpkg:google-chrome-stable"
    fi
  fi
fi

if [ -z "$chrome_version" ] && command -v rpm >/dev/null 2>&1; then
  chrome_version="$(rpm -q --qf '%{VERSION}\n' google-chrome-stable 2>/dev/null | head -n1)"
  if [ -n "$chrome_version" ] && [ "$chrome_version" != "package google-chrome-stable is not installed" ]; then
    source_note="rpm:google-chrome-stable"
  else
    chrome_version=""
  fi
fi

# If only Chromium is present, patch state is distro-specific for this CVE text.
if [ -z "$chrome_version" ]; then
  for cbin in chromium chromium-browser; do
    if command -v "$cbin" >/dev/null 2>&1; then
      echo "UNKNOWN"
      exit 2
    fi
  done
fi

if [ -z "$chrome_version" ]; then
  echo "UNKNOWN"
  exit 2
fi

if ver_lt "$chrome_version" "$FIXED"; then
  echo "VULNERABLE"
  exit 1
fi

echo "PATCHED"
exit 0

Sources

1. NVD CVE-2026-11282
2. Chrome Releases: Stable Channel Update for Desktop (149.0.7827.53 Linux)
3. Chromium issue 502023400
4. Chromium Linux sandbox README
5. Chromium sandbox design overview
6. FIRST EPSS API documentation
7. FIRST EPSS FAQ
8. CISA Known Exploited Vulnerabilities Catalog