CVE-2026-10911: Insufficient validation of untrusted input in Media in Google Chrome prior to 149

Synopsis

This is an insufficient input validation vulnerability in the Media component of Google Chrome versions prior to 149.0.7827.53. A remote attacker who has already compromised the Chrome renderer process can exploit this flaw by delivering a crafted HTML page, requiring the victim to interact with it. Successful exploitation enables a sandbox escape, giving the attacker code execution outside Chrome's sandboxed renderer and full access to the host system across confidentiality, integrity, and availability. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted HTML page over the network, so the target service or browser must be reachable from an external or remote origin.

• AuthenticationNot required

  No account or credential is needed to initiate the attack; the crafted page alone is sufficient once delivered.

• Victim interactionRequired

  The victim must open or navigate to the attacker-crafted HTML page, making this a social-engineering or drive-by delivery scenario.

• Attack complexityDetail

  Attack complexity is high, meaning the attacker must first achieve renderer process compromise before this sandbox-escape primitive becomes usable, introducing a significant prerequisite condition.

Blast Radius

• A successful sandbox escape lets the attacker execute arbitrary code in the context of the host OS process, bypassing Chrome's sandboxed renderer boundary.
• The attacker reads files, credentials, and session data accessible to the user running Chrome on the host.
• The attacker modifies files, configuration, or persisted data on the host system.
• The attacker can crash or destabilize host-level processes, disrupting service availability beyond the browser itself.