CVE-2026-11079: Insufficient validation of untrusted input in Codecs in Google Chrome prior to 149

Synopsis

An out-of-bounds memory write vulnerability exists in the Codecs component of Google Chrome prior to version 149.0.7827.53. The flaw is reachable over the network and requires no authentication, but does require a victim to open a crafted video file, placing it in the social-engineering category. Successful exploitation gives the attacker full read, write, and crash capability within the browser process, opening the door to remote code execution or data theft. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the malicious video file over the network, so the victim's browser must be reachable or the victim must browse to an attacker-controlled resource.

• AuthenticationNot required

  No account or credential of any kind is needed; the attack works against any unauthenticated visitor who opens the crafted file.

• Victim interactionRequired

  The victim must open or play a crafted video file, making this a social-engineering attack that requires the attacker to lure the user to malicious content.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental preconditions.

Blast Radius

• The attacker writes arbitrary data outside the intended buffer in the Codecs component, which can corrupt heap memory used by the browser process.
• With high confidentiality impact, the attacker reads in-memory content such as session tokens, saved credentials, and page data from the current browser context.
• With high integrity impact, the attacker modifies in-process data structures, enabling code injection or manipulation of rendered page content.
• With high availability impact, the attacker crashes the browser process or destabilizes it in a way that causes a denial of service for the affected user.