CVE-2026-11250: Inappropriate implementation in DevTools in Google Chrome prior to 149

Synopsis

An inappropriate implementation flaw in the DevTools component of Google Chrome (versions prior to 149.0.7827.53) allows a remote attacker who has already compromised the renderer process to extract sensitive data from process memory by loading a crafted HTML page. The attack is reachable over the network, requires no authentication, but does require the victim to interact with a malicious page. Successful exploitation gives the attacker high-confidence access to confidential data, the ability to tamper with content, and the ability to disrupt the affected service. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing the victim to a crafted HTML page; the Chrome instance must be reachable through normal browser activity.

• AuthenticationNot required

  No account credentials or prior authentication are needed to initiate the attack against the target.

• Victim interactionRequired

  The victim must visit or be redirected to the attacker-controlled HTML page, making this a social-engineering or drive-by scenario.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other hard-to-control environmental factors; however, a pre-compromised renderer process is a prerequisite.

Blast Radius

• The attacker reads sensitive data directly from Chrome process memory, including session tokens, credentials, or other in-memory content.
• The attacker achieves high-integrity impact, meaning in-memory or rendered content can be modified or injected after the renderer compromise is leveraged.
• The affected Chrome process can be crashed or rendered unavailable, disrupting the user session entirely.
• Because the CVSS scope is Changed, impact can extend beyond the compromised renderer to other browser components or co-located processes.