CVE-2026-11237: Insufficient validation of untrusted input in Media in Google Chrome prior to 149

Synopsis

Insufficient input validation in the Media component of Google Chrome (versions prior to 149.0.7827.53) allows a remote attacker who has already compromised the renderer process to spoof the browser UI by serving a crafted HTML page. The attack requires the victim to visit the malicious page and carries high complexity due to the prerequisite renderer compromise, but the CVSS v3.1 scope is changed, reflecting the ability to affect components outside the sandboxed renderer. Exploitation enables full confidentiality, integrity, and availability impact across affected scope. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted HTML page over the network, so the victim's browser must be reachable to or directed toward an attacker-controlled web origin.

• AuthenticationNot required

  No account or credential is needed; any unauthenticated remote party can serve the malicious page.

• Victim interactionRequired

  The victim must navigate to or load the crafted HTML page, making social engineering (phishing link, malicious ad, redirected URL) a prerequisite.

• Attack complexityDetail

  Attack complexity is high because the attacker must first have compromised the renderer process before UI spoofing becomes possible, requiring a multi-stage exploitation chain.

Blast Radius

• A successful attacker can spoof trusted browser UI elements, deceiving the victim into believing they are interacting with a legitimate origin or security dialog.
• Confidentiality impact is high: the spoofed UI can harvest credentials, authentication tokens, or other sensitive data the user believes they are submitting to a trusted site.
• Integrity impact is high: the attacker can manipulate what the user sees and acts on, causing the victim to approve or submit data intended for a fraudulent destination.
• Availability impact is high: the attacker can disrupt the browser session or render the browser interface non-functional from the user's perspective.