CVE-2026-11095: Insufficient validation of untrusted input in Codecs in Google Chrome prior to 149

Synopsis

This is an insufficient input validation vulnerability in the Codecs component of Google Chrome prior to version 149.0.7827.53. The flaw is reachable over the network with no authentication required, but it does require a victim to interact with a crafted HTML page, and it assumes the attacker has already compromised the renderer process. Successful exploitation enables a full sandbox escape, giving the attacker the ability to read sensitive data, tamper with files, and disrupt services outside the browser sandbox. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the victim over the network by serving a crafted HTML page, making internet or intranet exposure a prerequisite.

• AuthenticationNot required

  No account credentials or prior authentication are needed to deliver the malicious page to the victim.

• Victim interactionRequired

  The victim must visit or be directed to the attacker-controlled HTML page, requiring a social engineering or phishing step.

• Attack complexityDetail

  Attack complexity is Low, meaning the exploit is reliable and does not depend on race conditions or specific memory layout, though it does assume the renderer process has already been compromised as a prerequisite step.

Blast Radius

• Attacker escapes the Chrome sandbox and gains code execution in the context of the host process, breaking the browser's primary isolation boundary.
• Confidential data accessible to the browser user, including stored credentials, session tokens, and local files, becomes readable outside the sandbox.
• The attacker can write to or modify files and system state that the sandboxed renderer would normally be forbidden from touching.
• The host process or dependent services can be crashed or destabilized, causing denial of service on the affected system.