CVE-2026-11256: Integer overflow in GPU in Google Chrome prior to 149

Synopsis

An integer overflow in the GPU component of Google Chrome (versions prior to 149.0.7827.53) allows a remote attacker who has already compromised the renderer process to escape the browser sandbox via a crafted HTML page. The attack requires network access, no authentication, but does require the victim to interact with a malicious page, and exploit reliability is reduced by high attack complexity conditions. Successful exploitation gives the attacker code execution outside the Chrome sandbox, with full read, write, and availability impact on the host. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the victim over the network by serving a crafted HTML page, as indicated by AV:N in the CVSS vector.

• AuthenticationNot required

  No account or credential is needed; the attacker operates as an unauthenticated remote party (PR:N).

• Victim interactionRequired

  The victim must visit or load the attacker-controlled HTML page for the exploit chain to trigger (UI:R).

• Attack complexityDetail

  Attack complexity is rated High (AC:H), meaning the attacker depends on having already achieved renderer-process compromise before this integer overflow can be used to escape the sandbox.

Blast Radius

• A successful attacker escapes the Chrome sandbox and gains code execution at the privilege level of the browser process on the host.
• With high confidentiality impact (C:H), the attacker reads data accessible to the browser process, including stored credentials, session tokens, and cached content.
• With high integrity impact (I:H), the attacker modifies files, registry entries, or other host-level resources writable by the browser process.
• With high availability impact (A:H), the attacker crashes or otherwise disrupts the browser process and any dependent host services.