CVE-2026-11236: Insufficient policy enforcement in Web Bluetooth in Google Chrome prior to 149

Synopsis

An insufficient policy enforcement flaw in the Web Bluetooth component of Google Chrome prior to version 149.0.7827.53 allows a remote attacker who has already compromised the renderer process to escape the browser sandbox via a crafted HTML page. The vulnerability is reachable over the network but requires victim interaction and involves high attack complexity, reflecting the prerequisite of a compromised renderer. Successful exploitation gives the attacker full read, write, and availability impact on the host beyond the browser sandbox. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted HTML page over the network, requiring the victim's browser to reach an attacker-controlled resource.

• AuthenticationNot required

  No account or credential is needed; the attack is launched from an unauthenticated remote position.

• Victim interactionRequired

  The victim must navigate to or load a crafted HTML page, making social engineering a necessary part of the attack chain.

• Attack complexityDetail

  Exploitation is rated high complexity because it presupposes a prior renderer process compromise before the sandbox escape becomes possible.

Blast Radius

• Attacker escapes the Chrome browser sandbox and gains code execution in the context of the host process, bypassing the browser's primary isolation boundary.
• Full read access to host-level files and memory outside the renderer sandbox becomes available, including credentials, session data, and other sensitive on-disk material.
• Attacker can write or modify files and data on the host system beyond what the sandboxed renderer is permitted to touch.
• The host process and any services sharing its privilege level can be crashed or made unavailable.