CVE-2026-11248: Inappropriate implementation in Google Lens in Google Chrome prior to 149

Synopsis

An inappropriate implementation vulnerability in the Google Lens feature of Google Chrome (versions prior to 149.0.7827.53) allows a remote attacker to bypass navigation restrictions by delivering a crafted HTML page to a victim. The attack is reachable over the network, requires no authentication, but depends on the victim interacting with a malicious page. Successful exploitation enables full read, write, and availability impact on the affected scope. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the victim over the network by delivering a crafted HTML page, making the service's network exposure a prerequisite.

• AuthenticationNot required

  No credentials or account are needed; the attacker can target any user who visits the malicious page.

• Victim interactionRequired

  The victim must visit or be redirected to a crafted HTML page, requiring a social-engineering or drive-by delivery step.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and imposes no special preconditions such as race conditions or specific memory layout requirements.

Blast Radius

• A successful attacker reads sensitive data stored or accessible in the browser context, including session tokens, saved credentials, and page content.
• The attacker modifies browser-controlled data or state, enabling content injection or tampering with navigation behavior.
• The attacker can disrupt or crash the affected browser process, causing loss of availability for the user session.