CVE-2026-11056: Insufficient validation of untrusted input in SiteIsolation in Google Chrome on Windows prior to 149

Synopsis

This is a sandbox escape vulnerability in Google Chrome's SiteIsolation component on Windows. An attacker who has already compromised the renderer process can exploit insufficient input validation by directing a victim to a crafted HTML page, allowing the attacker to break out of Chrome's security sandbox. Successful exploitation gives the attacker full code execution in the context of the browser process, bypassing the isolation that normally contains renderer-level compromises. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted HTML page over the network, so the target must be reachable to receive and load attacker-controlled web content.

• AuthenticationNot required

  No account or credentials are needed; any user who visits the crafted page is exposed.

• Victim interactionRequired

  The victim must navigate to or be redirected to the attacker's crafted HTML page, making this a social-engineering or drive-by scenario.

• Attack complexityDetail

  Attack complexity is Low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental factors beyond the attacker having a compromised renderer process.

Blast Radius

• The attacker escapes Chrome's renderer sandbox and executes arbitrary code in the higher-privileged browser process on the victim's Windows host.
• With browser-process access, the attacker reads files and credentials accessible to the logged-in user, including cookies, saved passwords, and local documents.
• The attacker writes or modifies files on the host filesystem within the user's permission scope, enabling persistence mechanisms such as dropping executables or altering startup entries.
• The compromised browser process can be leveraged to crash or destabilize Chrome, disrupting the user's session and any dependent web-based workflows.