CVE-2026-11077: Bad cast in Dawn in Google Chrome prior to 149

Synopsis

A bad cast vulnerability in Dawn, the graphics backend used by Google Chrome, allows a remote attacker to execute arbitrary code inside the browser sandbox via a crafted HTML page. The vulnerability is reachable over the network and requires no authentication, though a victim must visit a malicious page. Successful exploitation gives an attacker code execution within the Chrome sandbox, which combined with a sandbox escape could lead to full system compromise. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network; the targeted Chrome instance must be able to reach and render an attacker-controlled HTML page.

• AuthenticationNot required

  No credentials or account are needed; any unauthenticated attacker who can serve a page to the victim can attempt exploitation.

• Victim interactionRequired

  The victim must visit a crafted HTML page, making this a social-engineering vector requiring the attacker to lure the user to a malicious URL.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental factors.

Blast Radius

• Executes arbitrary code inside the Chrome renderer sandbox, giving the attacker control over the sandboxed process.
• Reads sensitive in-browser data such as session tokens, stored credentials, and page content from the compromised renderer.
• Modifies in-browser state and can interact with web content on behalf of the victim within the sandbox.
• If chained with a sandbox escape, achieves full code execution on the underlying host with the privileges of the Chrome process.