Insufficient policy enforcement in Blink in Google Chrome prior to 149

CVE-2026-11292 is a Blink content security policy (CSP) bypass in Google Chrome before 149.0.7827.53. An attacker can lure a user to a crafted HTML page and get Blink to misapply or bypass CSP restrictions that a site expected the browser to enforce. Affected builds are Chrome versions prior to 149.0.7827.53 on platforms that consume that Chromium code; distro packages may ship the fix as a backport rather than the exact upstream version string.

The vendor's MEDIUM 4.3 baseline is already conservative, and in enterprise reality I would push it down to LOW. The decisive friction is that this is not code execution, not sandbox escape, and not a direct data-theft primitive; it is a client-side policy bypass that still needs user interaction and usually only becomes materially dangerous when paired with a separate web-app weakness or a very specific site workflow that relies on CSP as the last guardrail.

Why this verdict

• User interaction cuts this down immediately: the attacker must get a user to open crafted web content, which means delivery controls and browser auto-update shrink reach.
• Impact is narrow: the published vector is only I:L with C:N/A:N, so this is not an RCE, sandbox escape, credential dump, or workstation persistence path by itself.
• Exploit economics are poor: EPSS is effectively negligible, there is no KEV listing, and I found no public PoC or campaign signal.
• The prerequisite implies a browser-session attack, not initial compromise at scale: you need vulnerable client browsers and a web scenario where bypassing CSP actually changes the outcome.
• Widespread Chrome deployment is the only real amplifier: if this were paired with a broadly exploitable web-app condition, prevalence would matter more, but the standalone CVE does not justify MEDIUM urgency across 10,000 hosts.

Why not higher?

A higher rating would require either endpoint compromise potential, credible evidence of active exploitation, or a downstream impact stronger than low-integrity web abuse. None of that is present here. This is a security-boundary weakening inside the browser, but it does not by itself hand over the machine or the enterprise.

Why not lower?

It is not IGNORE because CSP exists to contain exactly the kind of script and content abuse attackers want, and bypassing it can still matter for sensitive apps. Chrome is also massively deployed, so even a modest per-user issue can become noisy if patch hygiene is poor.

1. Force browser evergreen compliance — Use your endpoint manager to verify Chrome and Chromium-family packages are auto-updating and restarting cleanly. For a LOW verdict there is no SLA (treat as backlog hygiene), but this is still the cleanest control because it removes the vulnerable engine rather than trying to detect a subtle policy bypass.
2. Prioritize high-risk user groups — If you cannot patch uniformly, move admins, finance users, and users handling sensitive SaaS sessions to the fixed build first. There is no SLA (treat as backlog hygiene) for LOW, so use normal change windows, but do not leave privileged browsing tiers on stale versions.
3. Use remote browser isolation where already deployed — For untrusted web destinations, RBI can reduce the chance that a crafted page reaches a vulnerable local rendering path. This is a containment measure, not a substitute for patching, and for LOW there is no SLA (treat as backlog hygiene).
4. Watch managed-browser inventory, not network scanners — Track exposure through EDR, MDM, software inventory, or browser management consoles because this bug is on the endpoint, not on a listening port. For LOW, there is no SLA (treat as backlog hygiene), so use routine asset-hygiene reporting rather than an emergency hunt.

Run this on the target endpoint or via your software-inventory agent anywhere Python 3 is available. Invoke it as python3 chrome_cve_2026_11292_check.py; it needs only normal user privileges and checks common Chrome/Chromium install locations on Windows, macOS, and Linux, then reports VULNERABLE, PATCHED, or UNKNOWN.

#!/usr/bin/env python3
# Check exposure to CVE-2026-11292 (Chrome/Blink CSP bypass)
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import shutil
import subprocess
import sys
from typing import Optional, List, Tuple

FIXED = (149, 0, 7827, 53)


def parse_version(text: str) -> Optional[Tuple[int, int, int, int]]:
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def cmp_ver(a: Tuple[int, int, int, int], b: Tuple[int, int, int, int]) -> int:
    return (a > b) - (a < b)


def run_cmd(cmd: List[str]) -> Optional[str]:
    try:
        out = subprocess.check_output(cmd, stderr=subprocess.STDOUT, text=True, timeout=10)
        return out.strip()
    except Exception:
        return None


def windows_candidates() -> List[List[str]]:
    cmds = []
    local = os.environ.get('LOCALAPPDATA', '')
    pf = os.environ.get('PROGRAMFILES', '')
    pfx86 = os.environ.get('PROGRAMFILES(X86)', '')
    paths = [
        os.path.join(local, 'Google', 'Chrome', 'Application', 'chrome.exe'),
        os.path.join(pf, 'Google', 'Chrome', 'Application', 'chrome.exe'),
        os.path.join(pfx86, 'Google', 'Chrome', 'Application', 'chrome.exe'),
        os.path.join(local, 'Chromium', 'Application', 'chrome.exe'),
        os.path.join(pf, 'Chromium', 'Application', 'chrome.exe'),
        os.path.join(pfx86, 'Chromium', 'Application', 'chrome.exe'),
        os.path.join(pf, 'Microsoft', 'Edge', 'Application', 'msedge.exe'),
        os.path.join(pfx86, 'Microsoft', 'Edge', 'Application', 'msedge.exe'),
    ]
    for p in paths:
        if p and os.path.exists(p):
            cmds.append([p, '--version'])
    return cmds


def unix_candidates() -> List[List[str]]:
    bins = [
        'google-chrome', 'google-chrome-stable', 'chromium', 'chromium-browser',
        'microsoft-edge', 'microsoft-edge-stable',
        '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
        '/Applications/Chromium.app/Contents/MacOS/Chromium',
        '/Applications/Microsoft Edge.app/Contents/MacOS/Microsoft Edge',
    ]
    cmds = []
    for b in bins:
        if os.path.isabs(b):
            if os.path.exists(b):
                cmds.append([b, '--version'])
        else:
            p = shutil.which(b)
            if p:
                cmds.append([p, '--version'])
    return cmds


def main() -> int:
    system = platform.system().lower()
    candidates = windows_candidates() if system == 'windows' else unix_candidates()

    if not candidates:
        print('UNKNOWN - No Chrome/Chromium-based browser executable found in common locations')
        return 2

    found = []
    for cmd in candidates:
        out = run_cmd(cmd)
        if not out:
            continue
        ver = parse_version(out)
        if ver:
            found.append((' '.join(cmd[:-1]), ver, out))

    if not found:
        print('UNKNOWN - Browser found but version could not be determined')
        return 2

    # Report the lowest discovered Chromium-family version; if any are vulnerable, call host vulnerable.
    vulnerable = []
    patched = []
    for name, ver, raw in found:
        if cmp_ver(ver, FIXED) < 0:
            vulnerable.append((name, ver, raw))
        else:
            patched.append((name, ver, raw))

    def fmt(v):
        return '.'.join(str(x) for x in v)

    if vulnerable:
        details = '; '.join(f'{name}={fmt(ver)}' for name, ver, _ in vulnerable)
        print(f'VULNERABLE - Found Chromium-family browser(s) below fixed version {fmt(FIXED)}: {details}')
        return 1

    details = '; '.join(f'{name}={fmt(ver)}' for name, ver, _ in patched)
    print(f'PATCHED - All discovered Chromium-family browser(s) are at or above fixed version {fmt(FIXED)}: {details}')
    return 0


if __name__ == '__main__':
    sys.exit(main())

Sources

1. Google Chrome Releases - Early Stable Update for Desktop (149.0.7827.53/.54)
2. openSUSE patchinfo - Chromium 149 security fixes including CVE-2026-11292
3. CISA Known Exploited Vulnerabilities Catalog
4. FIRST EPSS overview
5. FIRST EPSS API documentation
6. Statcounter U.S. desktop and tablet browser market share
7. NVD - CVE-2021-4321 similar Blink CSP bypass
8. NVD - CVE-2022-0117 similar Blink policy bypass