CVE-2026-11146: Insufficient validation of untrusted input in Chromoting in Google Chrome prior to 149

Synopsis

Insufficient input validation in the Chromoting component of Google Chrome (versions prior to 149.0.7827.53) allows a remote attacker who has already compromised the renderer process to escape the browser sandbox. The vulnerability is reachable over the network, requires no authentication, but does require the victim to interact with a crafted HTML page. Successful exploitation gives the attacker full read, write, and availability impact outside the sandbox boundary, effectively granting host-level code execution. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted HTML page over the network, so the vulnerable Chrome instance must be reachable or navigable to an attacker-controlled resource.

• AuthenticationNot required

  No account or credential is needed; the attacker only needs to direct the victim to a crafted page.

• Victim interactionRequired

  The victim must open or be redirected to a crafted HTML page, making social engineering or malicious-ad delivery a prerequisite.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental factors beyond the renderer-compromise prerequisite.

Blast Radius

• An attacker who escapes the sandbox reads files, credentials, and session tokens accessible to the browser process on the host.
• The attacker writes or modifies files and data on the host filesystem outside the sandbox boundary.
• The attacker can crash or terminate host-level processes, disrupting availability of the affected system.
• Because the scope is changed (S:C), impact extends beyond the browser itself to other components sharing the host.