CVE-2026-11202: Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 149

Synopsis

An inappropriate implementation flaw in Chrome for iOS (Google Chrome on iOS prior to 149.0.7827.53) allows a remote attacker to trigger a sandbox escape by convincing a user to visit a crafted HTML page. The vulnerability is reachable over the network with no authentication required, but does need the victim to load attacker-controlled content. Successful exploitation gives the attacker full read, write, and denial-of-service capability against the affected process, escaping the browser sandbox. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network; the target device must be able to reach attacker-controlled web content.

• AuthenticationNot required

  No account or credential is needed on the target system; the attack is fully unauthenticated.

• Victim interactionRequired

  The victim must visit a crafted HTML page, requiring the attacker to socially engineer or redirect the user to attacker-controlled content.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other variable environmental factors.

Blast Radius

• A successful sandbox escape lets the attacker read data held inside the Chrome sandbox, including session tokens, cached credentials, and browsing history.
• The attacker gains write capability within the escaped context, enabling modification of stored application data or injection of malicious content into the browser process.
• The attacker can crash or disrupt the Chrome process, causing a denial of service for the user.
• Because the sandbox boundary is broken, the attacker may pivot to interact with OS-level resources that the browser process can access on the iOS device.