CVE-2026-11112: Insufficient validation of untrusted input in Chromoting in Google Chrome on Linux prior to 149

Synopsis

Insufficient input validation in the Chromoting component of Google Chrome on Linux (versions prior to 149.0.7827.53) allows a remote attacker who has already compromised the renderer process to escape the browser sandbox via a crafted Chrome Extension. The attack is reachable over the network and requires the victim to interact with attacker-controlled content, but no authentication is needed. Successful exploitation gives the attacker full confidentiality, integrity, and availability impact outside the sandbox boundary. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the victim over the network, as the CVSS vector specifies AV:N (network-adjacent or internet-exposed Chrome sessions are in scope).

• AuthenticationNot required

  No credentials or account are needed; the attacker operates as an unauthenticated remote party prior to renderer compromise.

• Victim interactionRequired

  The victim must interact with attacker-controlled content (for example, visiting a malicious page or installing a crafted Chrome Extension), making this a social-engineering-dependent exploit path.

• Attack complexityDetail

  Attack complexity is Low (AC:L), meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other variable environmental factors once the renderer is compromised.

Blast Radius

• A successful attacker escapes the Chrome sandbox entirely, gaining code execution in the context of the host Linux user running Chrome.
• Confidential data accessible to that user (session tokens, credentials, files, environment variables) is readable by the attacker.
• The attacker can write to or modify files and system state owned by the Linux user, including persistent configuration and application data.
• The attacker can crash, hang, or otherwise disrupt the Chrome process and any dependent services or workflows running under that user account.