CVE-2026-11173: Out of bounds write in V8 in Google Chrome prior to 149

Synopsis

An out-of-bounds write vulnerability in V8, the JavaScript engine embedded in Google Chrome, allows a remote attacker who has already compromised the renderer process to execute arbitrary code within the browser sandbox by delivering a crafted HTML page. The vulnerability is reachable over the network and requires no authentication, though the victim must visit a malicious or attacker-controlled page. Successful exploitation gives the attacker code execution inside the sandbox, which can be chained with a sandbox-escape to achieve full host compromise. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network; the target Chrome instance must be reachable in the sense that the victim's browser fetches the attacker-controlled HTML page.

• AuthenticationNot required

  No account or credential is needed; any unauthenticated remote attacker can serve the malicious page.

• Victim interactionRequired

  The victim must visit or be redirected to a crafted HTML page, making this a social-engineering or drive-by-delivery scenario.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other variable environmental factors beyond the renderer-process pre-compromise prerequisite noted in the description.

Blast Radius

• Executes arbitrary code inside the Chrome renderer sandbox, giving the attacker control over the sandboxed process.
• Reads in-memory data accessible to the renderer, including page content, session tokens, and form input captured before the sandbox boundary.
• Modifies in-renderer state, enabling manipulation of displayed content or preparation of a follow-on sandbox-escape payload.
• When chained with a sandbox-escape primitive, extends attacker control to the host operating system and any data or credentials accessible to the Chrome process.