CVE-2026-11179: Inappropriate implementation in ORB in Google Chrome prior to 149

Synopsis

An inappropriate implementation flaw in the Opaque Response Blocking (ORB) mechanism of Google Chrome prior to version 149.0.7827.53 allows a remote attacker to bypass site isolation. The attacker must trick a victim into visiting a crafted HTML page, requiring no authentication but relying on user interaction; the attack is reachable over the network. Successful exploitation gives the attacker high-confidence read access to cross-origin data, the ability to modify that data, and can disrupt the affected service. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted HTML page over the network, so the target Chrome instance must be reachable and the victim must browse to the attacker-controlled URL.

• AuthenticationNot required

  No account or credential is needed; the attack is launched from any unauthenticated web origin.

• Victim interactionRequired

  The victim must visit a crafted HTML page, making this a social-engineering vector where the attacker must persuade the user to open a malicious link.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental factors.

Blast Radius

• A successful attacker reads cross-origin response data that site isolation is meant to protect, including session tokens, authenticated API responses, and user-specific page content.
• The attacker can modify or tamper with data in the context of the affected browsing session, undermining integrity of cross-origin interactions.
• The attacker can disrupt the affected Chrome session or cause it to crash, denying service to the user.
• Because confidentiality, integrity, and availability are all rated HIGH, the full scope of a compromised browser context is accessible to the attacker.