Inappropriate implementation in ImageCapture in Google Chrome prior to 149

CVE-2026-11296 is an *ImageCapture* implementation flaw in Google Chrome that affects versions prior to 149.0.7827.53 on Linux and 149.0.7827.53/54 on Windows and macOS. The bug does not give an attacker initial code execution by itself; it only helps after the attacker has already compromised the Chrome renderer process, at which point a crafted HTML page can be used to escalate privileges and weaken the browser sandbox boundary.

The supplied vendor baseline of HIGH 7.5 overshoots real-world enterprise risk. The decisive fact is prerequisite friction: an attacker must first land renderer compromise with a separate bug, so this is a *second-stage chain component*, not a standalone internet-reachable foothold; that is why Google/Chromium’s own advisory trail tags this specific issue as Low severity even though the supplied CVSS string scores it higher.

Why this verdict

• Major downward adjustment for attacker position: exploitation starts from a *compromised renderer*, which implies the attacker already landed a separate browser exploit; this is post-initial-access within the browser security model, not unauthenticated remote compromise from scratch.
• Vendor-native signal points lower: Google/Chromium’s own advisory trail marks this specific issue as *Low*, which fits the real attack path better than the supplied 7.5 CVSS baseline.
• Low threat pressure: no KEV listing, no public PoC found, and supplied EPSS 0.00066 all argue against emergency prioritization despite Chrome’s ubiquity.

Why not higher?

This is not a one-bug, one-click endpoint takeover. The requirement for a separate renderer compromise is compounding friction: it assumes attacker sophistication, another exploitable bug, and a narrower set of successful chains than the base CVSS implies.

Why not lower?

A browser sandbox escape is still strategically valuable because it turns renderer footholds into meaningful host compromise. Chrome is everywhere in enterprise fleets, so even a chain-only bug deserves tracked remediation rather than backlog oblivion.

1. Enforce browser version telemetry — Pull exact Chrome build numbers from your endpoint platform and alert on anything below 149.0.7827.53; for a MEDIUM verdict there is no mitigation SLA, so use this as inventory discipline while you drive patching inside the ≤365 day remediation window.
2. Separate privileged work from daily browsing — Keep admins, helpdesk, and server operators off normal browsing sessions or move them to hardened admin workstations. This cuts the payoff of any sandbox-escape chain, and because there is no mitigation SLA for MEDIUM, treat it as a standing control rather than an emergency exception.
3. Turn on strong EDR detections for browser lineage — Prioritize detections for child-process creation, LOLBin execution, token abuse, and suspicious file writes originating from chrome.exe or equivalent browser parents. That will not stop the bug, but it improves odds of catching the post-escape stage while you remediate within the ≤365 day window.
4. Use browser isolation for high-risk user groups — Remote browser isolation or disposable browsing sessions meaningfully reduce the value of renderer-compromise-plus-escape chains for contractors, research users, and phishing-prone groups. There is no mitigation SLA here, so apply where the business risk justifies the operational cost.

Run this on the target endpoint or through your endpoint management agent, not from an auditor workstation. Invoke it with python3 check_cve_2026_11296.py; no admin rights are normally required, but elevated rights may help if Chrome is installed in a protected path. It checks installed Google Chrome versions across Windows, macOS, and Linux and prints VULNERABLE, PATCHED, or UNKNOWN.

#!/usr/bin/env python3
# check_cve_2026_11296.py
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import shutil
import subprocess
import sys
from typing import List, Optional, Tuple

THRESHOLD = (149, 0, 7827, 53)


def parse_version(s: str) -> Optional[Tuple[int, ...]]:
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', s)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def cmp_version(a: Tuple[int, ...], b: Tuple[int, ...]) -> int:
    la = list(a)
    lb = list(b)
    while len(la) < len(lb):
        la.append(0)
    while len(lb) < len(la):
        lb.append(0)
    return (la > lb) - (la < lb)


def run_version(cmd: List[str]) -> Optional[str]:
    try:
        p = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True, timeout=10)
        out = (p.stdout or '').strip()
        return out if out else None
    except Exception:
        return None


def discover_candidates() -> List[List[str]]:
    system = platform.system().lower()
    cmds = []

    if 'windows' in system:
        local = os.environ.get('LOCALAPPDATA', r'C:\Users\Default\AppData\Local')
        program_files = os.environ.get('ProgramFiles', r'C:\Program Files')
        program_files_x86 = os.environ.get('ProgramFiles(x86)', r'C:\Program Files (x86)')
        paths = [
            os.path.join(local, 'Google', 'Chrome', 'Application', 'chrome.exe'),
            os.path.join(program_files, 'Google', 'Chrome', 'Application', 'chrome.exe'),
            os.path.join(program_files_x86, 'Google', 'Chrome', 'Application', 'chrome.exe'),
        ]
        for p in paths:
            if os.path.exists(p):
                cmds.append([p, '--version'])
        if shutil.which('chrome'):
            cmds.append(['chrome', '--version'])
    elif 'darwin' in system:
        mac_path = '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'
        if os.path.exists(mac_path):
            cmds.append([mac_path, '--version'])
        if shutil.which('google-chrome'):
            cmds.append(['google-chrome', '--version'])
    else:
        for name in ['google-chrome', 'google-chrome-stable', 'chrome', 'chromium-browser', 'chromium']:
            path = shutil.which(name)
            if path:
                cmds.append([path, '--version'])

    # De-duplicate commands while preserving order
    seen = set()
    uniq = []
    for c in cmds:
        key = tuple(c)
        if key not in seen:
            uniq.append(c)
            seen.add(key)
    return uniq


def main() -> int:
    candidates = discover_candidates()
    if not candidates:
        print('UNKNOWN - Google Chrome executable not found')
        return 2

    found_versions = []
    for cmd in candidates:
        out = run_version(cmd)
        if not out:
            continue
        ver = parse_version(out)
        if ver:
            found_versions.append((cmd[0], ver, out))

    if not found_versions:
        print('UNKNOWN - Could not determine Chrome version')
        return 2

    vulnerable = []
    patched = []
    for path, ver, raw in found_versions:
        if cmp_version(ver, THRESHOLD) < 0:
            vulnerable.append((path, raw))
        else:
            patched.append((path, raw))

    if vulnerable:
        details = '; '.join([f'{p} => {r}' for p, r in vulnerable])
        print(f'VULNERABLE - {details}')
        return 1

    details = '; '.join([f'{p} => {r}' for p, r in patched])
    print(f'PATCHED - {details}')
    return 0


if __name__ == '__main__':
    sys.exit(main())

Sources

1. NVD CVE-2026-11296
2. Chrome Releases - Stable Channel Update for Desktop (June 2, 2026)
3. Chromium issue 502493950
4. CISA Known Exploited Vulnerabilities Catalog
5. FIRST EPSS API documentation
6. FIRST EPSS overview
7. Canadian Centre for Cyber Security advisory AV26-544