CVE-2026-11198: Insufficient validation of untrusted input in Codecs in Google Chrome prior to 149

Synopsis

Insufficient input validation in the Codecs component of Google Chrome (versions prior to 149.0.7827.53) allows a remote attacker to perform a sandbox escape by convincing a user to open a crafted video file. The vulnerability is reachable over the network with no authentication required, but does require a user to interact with a malicious file. Successful exploitation gives the attacker full confidentiality, integrity, and availability impact beyond the browser sandbox. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the malicious video file over the network, so the affected Chrome instance must be reachable or the user must browse to attacker-controlled content.

• AuthenticationNot required

  No account or credential of any privilege level is needed; the attacker requires only that the target visit a page or open a file.

• Victim interactionRequired

  The exploit is triggered only when a user opens or plays a crafted video file, requiring social engineering to deliver that interaction.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other variable environmental factors.

Blast Radius

• The attacker escapes the Chrome renderer sandbox, gaining code execution in a context outside the browser's isolation boundary.
• With sandbox escape achieved, the attacker reads files, stored credentials, and session tokens accessible to the browser process.
• The attacker can write or modify data on the host, including persisting files or altering application state.
• The attacker can crash or destabilize the affected service or underlying host process, causing a denial of service.