CVE-2026-11235: Insufficient policy enforcement in Compositing in Google Chrome prior to 149

Synopsis

Insufficient policy enforcement in the Compositing component of Google Chrome (versions prior to 149.0.7827.53) allows a remote attacker who has already compromised the renderer process to escape the browser sandbox and execute arbitrary code on the underlying host. The vulnerability is reachable over the network and requires no authentication, but does require the victim to visit a crafted HTML page. Successful exploitation gives the attacker full code execution outside the browser sandbox. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted HTML page over the network, so the vulnerable Chrome instance must be reachable or browsing to attacker-controlled content.

• AuthenticationNot required

  No account or credentials are needed; the attacker only needs the victim to load a crafted page.

• Victim interactionRequired

  The victim must visit or be redirected to a crafted HTML page, making this a social-engineering or drive-by delivery scenario.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other unpredictable environmental factors.

Blast Radius

• An attacker who already holds renderer compromise can break out of the Chrome sandbox and execute arbitrary code as the browser process user on the host.
• Code execution outside the sandbox gives read access to files and credentials accessible by that user account on the host system.
• The attacker can write or modify files on the host, enabling persistence mechanisms or further lateral movement.
• The attacker can terminate or disrupt any process running under the same user, causing service disruption on the affected host.