CVE-2026-11218: Inappropriate implementation in PlatformIntegration in Google Chrome on Windows prior to 149

Synopsis

An inappropriate implementation flaw in the PlatformIntegration component of Google Chrome on Windows (versions prior to 149.0.7827.53) allows a remote attacker to execute arbitrary code. The attack is reachable over the network and requires no authentication, but does require convincing the target user to perform specific UI gestures with a malicious file. Successful exploitation gives the attacker full read and write access to data within the browser's context. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing the target to a malicious file or page, so the Chrome instance must be reachable through normal browser traffic.

• AuthenticationNot required

  No account credentials or prior authentication are needed; the attacker interacts with the browser as an anonymous remote party.

• Victim interactionRequired

  Exploitation requires the attacker to convince the target user to perform specific UI gestures, making this a social-engineering-dependent attack vector.

• Attack complexityDetail

  Attack complexity is Low, meaning the exploit is reliable and does not depend on race conditions, special memory layout, or other variable environmental factors.

Blast Radius

• The attacker executes arbitrary code in the context of the browser process on the victim's Windows machine.
• High confidentiality impact means the attacker reads browser-accessible data, including session tokens, saved credentials, and page content from open tabs.
• High integrity impact means the attacker writes or modifies data within the browser's reach, including local files accessible to the browser process and stored browser data.
• No availability impact is indicated; the exploit does not crash or deny access to the service as part of its primary effect.