CVE-2026-11037: Out of bounds write in Codecs in Google Chrome prior to 149

Synopsis

An out-of-bounds write vulnerability in the Codecs component of Google Chrome (versions prior to 149.0.7827.53) allows a remote attacker to trigger a sandbox escape by convincing a user to open a crafted video file. The attack is reachable over the network, requires no authentication, but does require the victim to interact with malicious content. Successful exploitation gives the attacker full read, write, and availability impact outside the browser sandbox. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted video file over the network, so the Chrome instance must be reachable or the user must browse to attacker-controlled content.

• AuthenticationNot required

  No account or credentials are needed; any unauthenticated remote party can serve the malicious payload.

• Victim interactionRequired

  The victim must open or render a crafted video file, meaning the attacker must socially engineer the user into visiting a malicious page or opening a supplied file.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other unpredictable environmental factors.

Blast Radius

• The attacker escapes the Chrome browser sandbox and gains code execution in the context of the host process.
• Confidential data accessible to the browser process, including stored credentials, session tokens, and cached content, becomes readable by the attacker.
• The attacker can write or modify files and data accessible to the host process, including user profile data and local application state.
• The attacker can crash or destabilize the affected browser process or dependent system services, causing a denial of service.