CVE-2026-11041: Insufficient validation of untrusted input in Media in Google Chrome on Windows prior to 149

Synopsis

This is an insufficient input validation vulnerability in the Media component of Google Chrome on Windows, affecting versions prior to 149.0.7827.53. It is reachable over the network and requires no authentication, but does require a user to visit a crafted HTML page; however, it also requires the attacker to have already compromised the renderer process as a prerequisite. Successful exploitation enables a sandbox escape, giving the attacker code execution outside Chrome's sandboxed renderer and access to the underlying host system. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted HTML page over the network, so the target Chrome instance must be reachable or the user must browse to an attacker-controlled URL.

• AuthenticationNot required

  No credentials or account privileges are needed; the attack is initiated through a public web page with no login barrier.

• Victim interactionRequired

  The user must navigate to or load a crafted HTML page, making this a social-engineering vector that depends on the victim taking an action in their browser.

• Attack complexityDetail

  While the CVSS vector rates overall complexity as Low, the exploit description notes the attacker must have already compromised the renderer process, which is a significant pre-condition that raises the practical bar.

Blast Radius

• Attacker escapes Chrome's sandbox and gains code execution in the context of the Windows user running the browser.
• Files, credentials, and session data accessible to that Windows user account become readable.
• The attacker can write or modify files on the host filesystem within the user's permission scope.
• The host process can be crashed or further abused as a foothold for lateral movement on the underlying system.