CVE-2026-11119: Inappropriate implementation in GPU in Google Chrome on Android prior to 149

Synopsis

A sandbox escape vulnerability exists in the GPU implementation of Google Chrome for Android in versions prior to 149.0.7827.53. The flaw is reachable over the network and requires no prior authentication, though it does require a victim to visit a crafted HTML page; additionally, an attacker must have already compromised the renderer process as a prerequisite. Successful exploitation allows a remote attacker to break out of Chrome's sandbox, gaining the ability to read, modify, and disrupt data and processes beyond the browser's intended isolation boundary. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted HTML page over the network, so the victim's device must be reachable through a browser session exposed to remote content.

• AuthenticationNot required

  No account or credential is needed; the attack is launched from an unauthenticated web context.

• Victim interactionRequired

  The victim must navigate to or be redirected to a crafted HTML page, requiring a social-engineering or malicious-ad delivery step.

• Attack complexityDetail

  The exploit is condition-free at the network delivery layer, though a separate renderer-process compromise must already be in place before the sandbox escape can be triggered.

Blast Radius

• A successful attacker reads data outside the Chrome sandbox, including stored credentials, session tokens, and files accessible to the browser process.
• The attacker modifies data or injects code into processes that run outside the sandboxed renderer, including other app contexts on the device.
• The attacker disrupts or crashes services and processes beyond the browser, up to and including the host application layer on the Android device.
• Because the scope change token (S:C) is set, impact extends beyond the vulnerable component itself, affecting other security domains on the same device.