CVE-2026-11149: Insufficient validation of untrusted input in Extensions in Google Chrome prior to 149

Synopsis

An insufficient input validation vulnerability in the Extensions component of Google Chrome (versions prior to 149.0.7827.53) allows a remote attacker who has already compromised the renderer process to escalate privileges by serving a crafted HTML page. The attack requires no authentication but does involve a user visiting a malicious page, and it depends on the attacker having first gained a foothold in the renderer. Successful exploitation gives the attacker elevated access beyond normal renderer sandbox limits, enabling reads, writes, and disruption across affected components. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the victim over the network by serving a crafted HTML page from a remotely accessible host.

• AuthenticationNot required

  No account or credential is needed; the attacker operates without any authentication to the target system.

• Victim interactionRequired

  The victim must visit or be directed to the attacker-controlled HTML page, making this a social-engineering-dependent attack.

• Attack complexityDetail

  Exploitation is rated high complexity because it requires the attacker to have already compromised the renderer process before the privilege escalation step can occur.

Blast Radius

• A successful attacker gains elevated privileges beyond the Chrome renderer sandbox, allowing reads of data that the renderer should not be able to access, such as session tokens or locally stored credentials.
• The attacker can write or modify data accessible at the escalated privilege level, including extension state and browser-managed storage.
• The attacker can cause disruption or crashes at the elevated privilege level, affecting browser stability and any workload running within that browser context.