Inappropriate implementation in Passwords in Google Chrome prior to 149

CVE-2026-11294 is a Chrome Passwords UI spoofing flaw in builds prior to 149.0.7827.53 on Linux and 149.0.7827.53/54 on Windows/macOS. The published CVE record says a remote attacker can use a crafted HTML page to make Chrome present misleading password-related UI, which maps cleanly to *user-interface misrepresentation* rather than memory corruption or sandbox escape.

The vendor baseline of MEDIUM 4.3 is already restrained, but for enterprise patch triage it still overstates operational urgency. The chain requires a user to land on attacker-controlled content and then trust a spoofed prompt; the bug does not itself provide code execution, sandbox escape, auth bypass, or silent credential dumping. In practice this behaves like a phishing amplifier on a very common client, so it belongs in LOW: patch it on normal browser cadence, not in an emergency lane.

Why this verdict

• Requires user interaction: the attacker must get a victim to open malicious content, which compounds with every phishing control already in your stack.
• No direct system compromise primitive: the published record describes UI spoofing with I:L only; there is no silent credential read, sandbox escape, or arbitrary code execution.
• Client-side exposure is broad but shallow: Chrome is everywhere, but this bug is not remotely enumerable like a server CVE and does not create an internet-scale blast radius on its own.

Why not higher?

A higher rating would need a cleaner path from webpage to compromise: credential theft without user decision, direct data exposure, auth bypass, or code execution. None of that is present in the published record. This is materially weaker than the Chrome memory-corruption bugs in the same release train that can lead to sandbox escape or RCE.

Why not lower?

It is not IGNORE because Chrome is deployed everywhere and the affected surface is the password UX, which directly intersects with phishing-resistant goals. In a large fleet, even a low-conversion spoofing bug can still generate real help-desk load and some identity incidents if left unpatched too long.

1. Enforce phishing-resistant auth — Prioritize FIDO2/WebAuthn and strong conditional access on high-value apps so a spoofed password prompt is less useful even if a user bites. For a LOW verdict there is no SLA beyond normal hygiene, but this control should already be standard and any gaps should be queued with backlog priority.
2. Tighten browser channel compliance — Use enterprise browser management to keep Chrome on auto-update and block long-tail stragglers from sitting below 149.0.7827.53. For LOW, treat this as backlog hygiene and fold it into routine browser currency work rather than a special-response program.
3. Harden malicious-link interception — Safe Browsing, DNS/web filtering, click-time detonation, and remote browser isolation all break the chain before the spoofed UI ever renders. For LOW, maintain these controls continuously and verify coverage during normal control-validation cycles.
4. Watch identity-side detections — Because exploit telemetry is weak, monitor for stolen-credential use: impossible travel, fresh device registration, unusual OAuth consent, password reset anomalies, and MFA fatigue. For LOW, no special deadline applies, but make sure these detections remain enabled and routed.

Run this on the target endpoint or via your software-inventory/remote-exec tooling on managed workstations. Invoke it with python3 check_chrome_cve_2026_11294.py; no admin rights are required, but the script must be able to read installed application version metadata or execute the browser binary with --version.

#!/usr/bin/env python3
# Check Chrome/Chromium version exposure for CVE-2026-11294
# Outputs: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import shutil
import subprocess
import sys

THRESHOLD = (149, 0, 7827, 53)


def parse_version(text):
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def cmp_ver(a, b):
    return (a > b) - (a < b)


def run_cmd(cmd):
    try:
        out = subprocess.check_output(cmd, stderr=subprocess.STDOUT, text=True, timeout=5)
        return out.strip()
    except Exception:
        return None


def windows_candidates():
    candidates = []
    envs = [
        os.environ.get('PROGRAMFILES'),
        os.environ.get('PROGRAMFILES(X86)'),
        os.environ.get('LOCALAPPDATA'),
    ]
    suffixes = [
        r'Google\\Chrome\\Application\\chrome.exe',
        r'Chromium\\Application\\chrome.exe',
    ]
    for base in envs:
        if not base:
            continue
        for suf in suffixes:
            p = os.path.join(base, *suf.split('\\'))
            if os.path.exists(p):
                candidates.append(p)
    return candidates


def mac_candidates():
    return [
        '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
        '/Applications/Chromium.app/Contents/MacOS/Chromium',
        os.path.expanduser('~/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'),
        os.path.expanduser('~/Applications/Chromium.app/Contents/MacOS/Chromium'),
    ]


def linux_candidates():
    bins = [
        'google-chrome', 'google-chrome-stable', 'chromium', 'chromium-browser', 'chrome'
    ]
    found = []
    for b in bins:
        p = shutil.which(b)
        if p:
            found.append(p)
    return found


def detect_versions():
    system = platform.system().lower()
    candidates = []
    if 'windows' in system:
        candidates = windows_candidates()
    elif 'darwin' in system:
        candidates = mac_candidates()
    else:
        candidates = linux_candidates()

    seen = []
    for path in candidates:
        if not os.path.exists(path) and not shutil.which(path):
            continue
        out = run_cmd([path, '--version'])
        if not out:
            continue
        ver = parse_version(out)
        if ver:
            seen.append((path, ver, out))
    return seen


def main():
    seen = detect_versions()
    if not seen:
        print('UNKNOWN: could not determine installed Chrome/Chromium version')
        sys.exit(2)

    vulnerable = []
    patched = []
    for path, ver, raw in seen:
        if cmp_ver(ver, THRESHOLD) < 0:
            vulnerable.append((path, ver, raw))
        else:
            patched.append((path, ver, raw))

    if vulnerable:
        details = '; '.join([f'{p}={".".join(map(str, v))}' for p, v, _ in vulnerable])
        print(f'VULNERABLE: found version(s) below 149.0.7827.53 -> {details}')
        sys.exit(1)

    details = '; '.join([f'{p}={".".join(map(str, v))}' for p, v, _ in patched])
    print(f'PATCHED: found version(s) at or above 149.0.7827.53 -> {details}')
    sys.exit(0)


if __name__ == '__main__':
    main()

Sources

1. Official CVE JSON record for CVE-2026-11294
2. Chrome Releases: Stable Channel Update for Desktop (June 2, 2026)
3. Chrome Releases: Early Stable Update for Desktop (May 29, 2026)
4. CISA Known Exploited Vulnerabilities Catalog
5. FIRST EPSS overview
6. Canadian Centre for Cyber Security advisory AV26-544
7. GovCERT.HK alert A26-06-08
8. openSUSE maintenance patchinfo including CVE-2026-11294