CVE-2026-11076: Type Confusion in CSS in Google Chrome prior to 149

Synopsis

A type confusion vulnerability in the CSS engine of Google Chrome prior to version 149.0.7827.53 allows a remote attacker to execute arbitrary code inside the browser sandbox by tricking a user into visiting a crafted HTML page. The attack is reachable over the network, requires no authentication, but does require the victim to interact with a malicious page. Successful exploitation gives the attacker arbitrary code execution within the Chrome sandbox, with high impact to confidentiality, integrity, and availability. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing the victim to a crafted HTML page, so the service must be reachable from an external network origin.

• AuthenticationNot required

  No account or credentials of any kind are required; the attacker can target any user who visits the malicious page.

• Victim interactionRequired

  The victim must visit or be redirected to a crafted HTML page, meaning the attacker depends on a social-engineering or redirect step to trigger the vulnerability.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental prerequisites.

Blast Radius

• Arbitrary code executes inside the Chrome renderer sandbox, giving the attacker control over the renderer process.
• The attacker reads data processed by the renderer, including page content, session tokens, and credentials entered in the browser.
• The attacker modifies in-browser state, potentially altering rendered content or intercepting form submissions.
• The renderer process crashes or is made unavailable, disrupting the user's browsing session for affected pages.