CVE-2026-11231: Inappropriate implementation in Safe Browsing in Google Chrome on Mac prior to 149

Synopsis

An inappropriate implementation flaw in the Safe Browsing component of Google Chrome on macOS allows a remote attacker to execute arbitrary code by convincing a user to open a malicious file. The vulnerability is reachable over the network and requires no authentication, though it does require the victim to interact with a crafted file delivered by the attacker. Successful exploitation gives the attacker the ability to read sensitive data and modify files or system state within the browser's context. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version of Chrome on Mac.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the malicious file over the network, so the targeted service or user must be reachable from an external or remote network location.

• AuthenticationNot required

  No account or credential is needed; the attacker can initiate the attack without authenticating to any service.

• Victim interactionRequired

  The victim must open or interact with the attacker-supplied malicious file, making this a social-engineering dependent attack.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, memory layout, or other unpredictable environmental factors.

Blast Radius

• The attacker executes arbitrary code in the context of the Chrome process on the victim's Mac, gaining the ability to read files, browser history, stored credentials, and session tokens accessible to that process.
• The attacker can write or modify files within reach of the compromised Chrome process, including cached data and user-writable directories.
• Confidentiality and integrity of data handled by the browser are both fully compromised; availability is not directly impacted by this vulnerability.