CVE-2026-11269: Inappropriate implementation in Extensions in Google Chrome prior to 149

Synopsis

An inappropriate implementation flaw in the Extensions subsystem of Google Chrome prior to version 149.0.7827.53 allows an attacker with a privileged network position to execute arbitrary code inside the Chrome sandbox. Reaching the vulnerability requires the attacker to be positioned on an adjacent network (such as a LAN or VPN) and requires the victim to interact with a crafted Chrome Extension. Successful exploitation gives the attacker full code execution within the sandbox, with high impact to confidentiality, integrity, and availability of the sandboxed process. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityDetail

  The attacker must occupy a privileged adjacent-network position (such as a shared LAN, VPN segment, or similar) to reach the affected service; remote internet-based exploitation is not supported by this vector.

• AuthenticationNot required

  No account credentials or prior authentication are needed; the attacker can initiate the attack without any login context.

• Victim interactionRequired

  A victim must interact with a crafted Chrome Extension, making social engineering or malicious extension delivery a prerequisite for exploitation.

• Attack complexityDetail

  Exploitation is rated high complexity, meaning the attacker must satisfy specific environmental conditions or timing constraints beyond simply reaching the target.

Blast Radius

• The attacker executes arbitrary code inside the Chrome sandbox process, gaining full control of that execution context.
• Sensitive data accessible to the sandboxed process, such as page content, stored credentials surfaced in extensions, and browser state, is readable by the attacker.
• The attacker can modify data within the sandboxed context, including extension storage, injected scripts, and in-page content.
• The sandboxed process can be crashed or made unresponsive, disrupting the user's browsing session and any extension-dependent functionality.