CVE-2026-11153: Side-channel information leakage in Forms in Google Chrome prior to 149

Synopsis

A side-channel information leakage vulnerability affects the Forms component in Google Chrome prior to version 149.0.7827.53. The flaw is reachable over the network with no authentication or user interaction required, allowing a remote attacker to serve a crafted HTML page that triggers cross-origin data exposure. Successful exploitation lets an attacker read data from other origins and tamper with it, violating both confidentiality and integrity. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing a target browser to a crafted HTML page hosted remotely.

• AuthenticationNot required

  No account or credential is needed; any unauthenticated remote party can serve the malicious page.

• Victim interactionNot required

  No user action beyond normal browsing is required to trigger the side-channel leakage.

• Attack complexityDetail

  Exploit conditions are straightforward and reliable, with no race conditions or special environmental setup required.

Blast Radius

• An attacker reads cross-origin data from other web origins loaded in the same browser session, including cookies, tokens, or page content that the same-origin policy is meant to protect.
• An attacker modifies cross-origin data reachable through the Forms component, allowing unauthorized writes or injections into protected contexts.
• The combined confidentiality and integrity impact means session hijacking, credential theft, or data manipulation are all within reach of a successful exploit.