CVE-2026-11102: Inappropriate implementation in Isolated Web Apps in Google Chrome prior to 149

Synopsis

An inappropriate implementation flaw in the Isolated Web Apps subsystem of Google Chrome (versions prior to 149.0.7827.53) allows a remote attacker to execute arbitrary code inside the browser sandbox. The attack is reachable over the network and requires no authentication, but the victim must interact with a malicious file, such as opening or downloading attacker-controlled content. Successful exploitation gives the attacker code execution within the sandbox context, with full impact on confidentiality, integrity, and availability of the affected process. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the malicious file over the network, so the targeted Chrome instance must be reachable or the user must browse to an attacker-controlled resource.

• AuthenticationNot required

  No account or credential of any kind is needed; any unauthenticated remote attacker can attempt the exploit.

• Victim interactionRequired

  The victim must interact with a malicious file, for example by opening or downloading attacker-supplied content, making this a social-engineering-dependent attack.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental factors beyond victim interaction.

Blast Radius

• Reads sensitive data accessible within the Chrome sandbox process, including stored session state and locally cached content.
• Modifies data and state within the sandboxed process, potentially altering rendered content or injecting behavior into the Isolated Web App context.
• Crashes or destabilizes the sandboxed renderer process, disrupting the availability of the affected Isolated Web App.
• Provides a foothold inside the sandbox that could be chained with a sandbox-escape vulnerability to reach the underlying host.