CVE-2026-11120: Insufficient validation of untrusted input in Enterprise Reporting in Google Chrome prior to 149

Synopsis

Insufficient input validation in the Enterprise Reporting component of Google Chrome prior to version 149.0.7827.53 allows a remote attacker who has already compromised the renderer process to escape the browser sandbox via a crafted HTML page. The attack is reachable over the network and requires no authentication, though it does require the victim to visit or interact with a malicious page. Successful exploitation gives the attacker code execution outside the browser sandbox, effectively escaping Chrome's primary security boundary. A patched-image rebuild at 149.0.7827.53 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted HTML page over the network, so the target service or user must be reachable from the attacker's position on the internet.

• AuthenticationNot required

  No account or credentials are needed; any unauthenticated user who can be directed to a malicious page is a viable target.

• Victim interactionRequired

  The victim must visit or otherwise load the attacker-controlled HTML page, making this a social-engineering or malicious-redirect scenario.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other unpredictable environmental factors, though it does assume the renderer process has already been compromised.

Blast Radius

• The attacker escapes the Chrome browser sandbox, gaining code execution in the context of the host process outside the renderer's security boundary.
• With sandbox escape achieved, the attacker reads files, credentials, and session data accessible to the user running Chrome on the host.
• The attacker writes or modifies files on the host filesystem and can persist malicious code across reboots.
• The attacker can crash or destabilize the host-level Chrome process and any dependent services, causing a denial of service.