CVE-2026-11086: Inappropriate implementation in Dawn in Google Chrome prior to 149

Synopsis

This is a sandbox escape vulnerability in the Dawn graphics component of Google Chrome versions prior to 149.0.7827.53. The flaw is reachable over the network and requires no authentication, but the attacker must first compromise the renderer process (for example, via a separate exploit) and then trick a user into visiting a crafted HTML page. Successful exploitation lets the attacker execute arbitrary code inside the browser sandbox, bypassing the isolation boundary meant to contain renderer-level compromises. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted HTML page over the network, so the target must be reachable via a browser making outbound network requests.

• AuthenticationNot required

  No account or credential is needed to serve the malicious page to the victim.

• Victim interactionRequired

  The victim must navigate to or be redirected to a crafted HTML page, making this a social-engineering or drive-by delivery scenario.

• Attack complexityDetail

  Exploiting the Dawn flaw itself is condition-free once renderer access is established, though chaining a renderer compromise as a prerequisite adds real-world complexity.

Blast Radius

• The attacker executes arbitrary code inside the Chrome sandbox, breaking the isolation boundary between the renderer and the rest of the host.
• With sandbox escape achieved, the attacker can read files and credentials accessible to the browser process on the host system.
• The attacker can write or modify data reachable by the browser process, including local storage, cached credentials, and profile data.
• The attacker can crash or destabilize the browser process, causing a denial of service for the affected user session.