CVE-2026-11241: Insufficient validation of untrusted input in Cast in Google Chrome prior to 149

Synopsis

Insufficient input validation in the Cast component of Google Chrome (versions prior to 149.0.7827.53) allows an attacker on the same local network segment to escalate privileges by tricking a victim into visiting a crafted HTML page. The attacker needs no prior authentication, but does require the victim to interact with malicious content, and exploitation results in full confidentiality, integrity, and availability impact on the affected browser session. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected Chrome version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityDetail

  The attacker must be on the same adjacent network segment (LAN or VPN) as the victim; remote exploitation over the open internet is not possible with this vector.

• AuthenticationNot required

  No account or credentials on the target system are needed before launching the attack.

• Victim interactionRequired

  The victim must visit or be redirected to a crafted HTML page, making social engineering or a man-in-the-middle content injection a necessary part of the attack chain.

• Attack complexityDetail

  Exploitation is reliable and imposes no special timing requirements, race conditions, or environmental preconditions beyond placing the attacker on the adjacent network.

Blast Radius

• A successful attacker reads sensitive browser data including cookies, stored credentials, and session tokens accessible to the Chrome process.
• The attacker can modify browser state, alter rendered content, or inject data into the active browsing session.
• The Cast component or the browser process can be crashed or rendered unresponsive, disrupting the user's session.
• Privilege escalation within the browser context may allow the attacker to reach resources or permissions beyond what the victim's normal browsing session would permit.