CVE-2026-11211: Integer overflow in V8 in Google Chrome prior to 149

Synopsis

An integer overflow in V8, the JavaScript engine embedded in Google Chrome, affects all versions prior to 149.0.7827.53. The vulnerability is reachable over the network and requires no authentication, but does require a victim to visit a crafted HTML page. Successful exploitation gives a remote attacker arbitrary code execution inside the Chrome sandbox. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network; the target Chrome instance must be able to load an externally hosted or attacker-controlled HTML page.

• AuthenticationNot required

  No account, credential, or session token is needed; any unauthenticated user browsing to the crafted page is a valid target.

• Victim interactionRequired

  The victim must visit a crafted HTML page, making this a social-engineering vector that requires luring or redirecting the target to attacker-controlled content.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other variable environmental factors.

Blast Radius

• The attacker executes arbitrary code inside the Chrome renderer sandbox, gaining full control of the sandboxed process.
• Confidential data processed by the renderer, including page content, cookies, and in-memory credentials, is readable by the attacker.
• The attacker can write or modify data within the sandbox's reach, including cached files and storage accessible to the renderer process.
• The renderer process can be crashed or made unresponsive, disrupting the browsing session for the affected user.