CVE-2026-11151: Insufficient validation of untrusted input in Password Manager in Google Chrome prior to 149

Synopsis

Insufficient input validation in the Password Manager component of Google Chrome (versions prior to 149.0.7827.53) allows a remote attacker who has already compromised the renderer process to escape the browser sandbox via a crafted HTML page. The attack is reachable over the network, requires no authentication, but does need the victim to interact with a malicious page, and exploitation is complex due to the prerequisite renderer compromise. Successful exploitation gives the attacker full read, write, and availability impact on the affected system. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted HTML page over the network, requiring the victim's browser to reach or be reached by the attacker-controlled content.

• AuthenticationNot required

  No account or credential is needed; the attack is launched from an unauthenticated remote position.

• Victim interactionRequired

  The victim must visit or be directed to a crafted HTML page, making social engineering or malicious ad delivery part of the attack chain.

• Attack complexityDetail

  Exploitation is high complexity because the attacker must first achieve a renderer process compromise before the sandbox escape becomes reachable.

Blast Radius

• The attacker breaks out of the Chrome sandbox, gaining code execution at the privilege level of the browser process on the host.
• Confidential data accessible to the browser process, including stored credentials and session state, becomes readable by the attacker.
• The attacker can write to or modify files and system state accessible to the browser process on the host.
• The affected Chrome process and dependent services can be crashed or made unavailable.