CVE-2026-11046: Insufficient validation of untrusted input in Media in Google Chrome prior to 149

Synopsis

Insufficient input validation in the Media component of Google Chrome (versions before 149.0.7827.53) allows a remote attacker who has already compromised the renderer process to execute arbitrary code inside the browser sandbox by serving a crafted HTML page. The vulnerability is reachable over the network and requires no authentication, though the victim must visit a malicious page. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing the victim to a crafted HTML page hosted on an attacker-controlled server.

• AuthenticationNot required

  No account or credential is needed on the targeted system; any unauthenticated remote attacker can attempt the exploit.

• Victim interactionRequired

  The victim must navigate to or be redirected to a crafted HTML page, making this a social-engineering or drive-by-navigation scenario.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental prerequisites beyond renderer compromise.

Blast Radius

• A successful attacker executes arbitrary code inside the Chrome sandbox on the victim host, gaining full control over the compromised renderer process.
• With sandbox execution achieved, the attacker can read data accessible to that process, including in-page credentials, session tokens, and DOM content from the current origin.
• The attacker can modify page content and behavior, enabling phishing overlays, credential harvesting forms, or silent data exfiltration within the renderer context.
• Depending on further sandbox-escape primitives present, this foothold can serve as a stepping stone toward broader host-level compromise.