CVE-2026-11052: Type Confusion in GPU in Google Chrome on Windows prior to 149

Synopsis

A type confusion vulnerability in the GPU component of Google Chrome on Windows (versions prior to 149.0.7827.53) allows a remote attacker who has already compromised the renderer process to escape the browser sandbox via a crafted HTML page. The attack is reachable over the network, requires no authentication, but does need the victim to visit or interact with a malicious page. Successful exploitation gives the attacker full read, write, and execution capability outside the Chrome sandbox on the affected Windows host. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the victim over the network by serving a crafted HTML page from a remote origin (AV:N).

• AuthenticationNot required

  No account or credential is needed; the attacker requires no prior authentication on any system (PR:N).

• Victim interactionRequired

  The victim must visit or interact with the attacker-controlled page in Chrome, making this a user-interaction-dependent attack (UI:R).

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions or specific memory layout (AC:L).

Blast Radius

• An attacker who triggers the type confusion escapes the Chrome renderer sandbox and gains code execution in a higher-privilege Windows process outside the sandbox boundary.
• With sandbox escape achieved, the attacker reads files, credentials, and session material accessible to the Windows user running Chrome.
• The attacker writes or modifies files and registry entries on the host, enabling persistence mechanisms or lateral-movement staging.
• The attacker crashes or destabilizes host processes, causing denial of service to the affected Windows endpoint.