CVE-2026-11239: Inappropriate implementation in Extensions in Google Chrome prior to 149

Synopsis

This is a privilege escalation vulnerability in the Extensions component of Google Chrome versions prior to 149.0.7827.53. An attacker who has already compromised Chrome's renderer process can exploit an inappropriate implementation flaw by luring a victim to a crafted HTML page, escalating privileges beyond the renderer sandbox. Successful exploitation gives the attacker high-level access to confidentiality, integrity, and availability of the affected system. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the victim over the network, delivering a crafted HTML page from a remote origin, making network exposure a prerequisite.

• AuthenticationNot required

  No account or credentials are needed on the target system; the attack is initiated purely through the browser rendering a crafted page.

• Victim interactionRequired

  The victim must visit or be redirected to a crafted HTML page, requiring a social-engineering step such as a phishing link or malicious ad.

• Attack complexityDetail

  Attack complexity is high, meaning the attacker must first have compromised the renderer process before this escalation step is possible, introducing a significant environmental prerequisite.

Blast Radius

• A successful attacker reads sensitive data accessible to the elevated process, including stored credentials, session tokens, and local files exposed to Chrome's privilege level.
• The attacker modifies application state or system data at the escalated privilege level, including browser profile data and potentially host filesystem contents.
• The attacker disrupts availability of the affected Chrome instance and potentially dependent system services by exercising escalated process control.