CVE-2026-11279: Out of bounds read in DevTools in Google Chrome prior to 149

Synopsis

An out-of-bounds read vulnerability in the DevTools component of Google Chrome prior to version 149.0.7827.53 allows a remote attacker to execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. The attack is reachable over the network and requires no authentication, though it does require the victim to visit or load attacker-controlled content. Successful exploitation gives the attacker code execution within the sandboxed renderer process. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must deliver the crafted HTML page to the victim over the network, so the Chrome instance must be reachable or browsing attacker-controlled content accessible via the internet or internal network.

• AuthenticationNot required

  No account or credentials are needed; the exploit is triggered purely by the victim loading a crafted page.

• Victim interactionRequired

  The victim must visit or otherwise load a crafted HTML page, making this a social-engineering or malicious-link scenario.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental factors.

Blast Radius

• The attacker gains arbitrary code execution within the Chrome renderer sandbox, allowing execution of attacker-supplied instructions in that process context.
• Confidentiality impact is high: the attacker can read in-process memory, potentially capturing session tokens, credentials, or page content loaded in the affected tab.
• Integrity impact is high: the attacker can modify data processed within the sandboxed renderer, including manipulating page content or writing to accessible storage APIs.
• Availability impact is high: the attacker can crash or destabilize the renderer process, taking down the affected browsing context.