CVE-2026-11047: Inappropriate implementation in Base in Google Chrome on Windows prior to 149

Synopsis

This is a sandbox-escape vulnerability in the Base component of Google Chrome on Windows, affecting all versions prior to 149.0.7827.53. It is reachable over the network and requires no authentication, though a victim must open a crafted HTML page; it also requires the attacker to have already compromised the Chrome renderer process as a prerequisite. Successful exploitation allows the attacker to break out of Chrome's sandbox, gaining full access to the underlying Windows host with the ability to read data, modify files, and run arbitrary code. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted HTML page over the network, requiring the victim's browser to reach attacker-controlled content.

• AuthenticationNot required

  No credentials or account are needed; the attack is launched against any user who browses to the malicious page.

• Victim interactionRequired

  The victim must open or navigate to the attacker's crafted HTML page, making this a social-engineering or drive-by scenario.

• Attack complexityDetail

  The base exploit path is condition-free and reliable once the renderer is compromised, though obtaining initial renderer compromise is itself a prerequisite that adds real-world complexity.

Blast Radius

• An attacker who escapes the sandbox reads files and data accessible to the Chrome process on the Windows host, including stored credentials, cookies, and session tokens.
• The attacker can write to or modify files on the host filesystem, including user-profile data and application files.
• The attacker can crash or terminate the affected Chrome process and other processes reachable from the host context, disrupting service.
• With code execution outside the sandbox, the attacker can install persistent payloads, pivot to other services on the host, or escalate privileges further.