CVE-2026-11058: Integer overflow in CredentialProvider in Google Chrome on Windows prior to 149

Synopsis

An integer overflow in the CredentialProvider component of Google Chrome on Windows allows a remote attacker who has already compromised the browser's renderer process to escalate privileges at the operating system level. The attack requires network reachability, no authentication, victim interaction to load a crafted HTML page, and a high-complexity precondition: the attacker must first have renderer-level access. Successful exploitation grants the attacker elevated OS privileges, enabling broad control over the affected Windows host. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the victim over the network by delivering a crafted HTML page, making the service's network exposure a prerequisite.

• AuthenticationNot required

  No account or credentials are needed to initiate the attack; the attacker operates as an unauthenticated remote party.

• Victim interactionRequired

  The victim must load a crafted HTML page in the browser, requiring a social-engineering step such as clicking a malicious link.

• Attack complexityDetail

  Exploitation is high-complexity because the attacker must first have compromised the Chrome renderer process before the integer overflow can be leveraged for privilege escalation.

Blast Radius

• A successful attacker gains elevated OS-level privileges on the affected Windows host, moving beyond the Chrome sandbox.
• With elevated privileges, the attacker can read sensitive files and credentials stored on the host, including those outside the browser's normal access scope.
• The attacker can modify system configuration, install persistent software, or tamper with other processes running on the same host.
• Availability of the host can be disrupted by terminating critical processes or corrupting system state.