CVE-2026-11158: Insufficient validation of untrusted input in Downloads in Google Chrome on Mac prior to 149

Synopsis

This is an insufficient input validation vulnerability in the Downloads component of Google Chrome on macOS, affecting all versions prior to 149.0.7827.53. An attacker with local access who can induce a user to interact with a crafted AppleScript command can exploit this flaw. Successful exploitation enables a sandbox escape, giving the attacker read access to sensitive data, the ability to modify files, and the ability to crash or disrupt the affected service. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network path to the service is required.

• AuthenticationNot required

  No account credentials or prior authentication are needed to attempt the exploit.

• Victim interactionRequired

  The targeted user must interact with a crafted AppleScript command, making this a social-engineering-dependent attack.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions or specific memory layout.

Blast Radius

• A successful attacker escapes the Chrome sandbox and gains access to files and data outside the browser's restricted process boundary.
• Confidential data stored on the host, including session tokens, credentials cached by the browser, and user files, becomes readable to the attacker.
• The attacker can modify persisted files and application data on the affected macOS host.
• The attacker can crash or disrupt the Chrome process and potentially other services reachable from the escaped sandbox context.