CVE-2026-11092: Insufficient policy enforcement in DevTools in Google Chrome prior to 149

Synopsis

Insufficient policy enforcement in the DevTools component of Google Chrome (versions prior to 149.0.7827.53) allows an attacker to escalate privileges by convincing a target user to install a malicious browser extension. The vulnerability is reachable over the network and requires no authentication, but does depend on victim interaction to complete the attack chain. Successful exploitation gives the attacker high-severity access to confidential data, the ability to modify data, and the ability to crash or disrupt the affected service. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the victim over the network, delivering the malicious extension via a web-based or network-accessible distribution channel.

• AuthenticationNot required

  No authentication or account credentials are needed; the attacker interacts with the victim directly without any privileged access to the target system.

• Victim interactionRequired

  The attack requires social engineering: the victim must be convinced to install a crafted malicious Chrome extension for the exploit to proceed.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other hard-to-control environmental factors.

Blast Radius

• A successful attacker reads confidential browser data, including stored credentials, session tokens, and browsing history accessible to the extension context.
• A successful attacker modifies browser state and persisted data, including altering page content, injecting scripts into visited pages, and tampering with stored extension or application data.
• A successful attacker can crash or disrupt the Chrome process, causing loss of availability for the affected user session.
• Privilege escalation via the DevTools policy bypass may allow the extension to operate outside its declared permission scope, broadening access beyond what the user consented to grant.