CVE-2026-11171: Integer overflow in Blink in Google Chrome prior to 149

Synopsis

An integer overflow in Blink, the rendering engine used by Google Chrome, allows a remote attacker to execute arbitrary code inside the browser sandbox by serving a crafted HTML page. The vulnerability is reachable over the network with no authentication required, but the victim must visit a malicious page, making it a drive-by or social-engineering attack. Successful exploitation gives an attacker code execution within the Chrome sandbox, with high impact on confidentiality, integrity, and availability. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing the victim to a crafted HTML page, so the Chrome instance must be reachable and able to load remote content.

• AuthenticationNot required

  No account or credentials are needed on any system; the attacker only needs to serve a malicious page.

• Victim interactionRequired

  The victim must navigate to or be redirected to the attacker-controlled HTML page, requiring at minimum a click or redirect for exploitation.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special race conditions, memory layout knowledge, or environmental prerequisites.

Blast Radius

• An attacker executes arbitrary code inside the Chrome renderer sandbox, gaining control of the rendering process for the affected tab.
• Confidential data processed by or displayed in the browser, such as session tokens, form input, and page content, is readable by the attacker.
• The attacker can modify rendered content and browser state, enabling tampering with data the user reads or submits.
• The affected Chrome renderer process can be crashed or destabilized, disrupting the user's browsing session.