CVE-2026-11282: Insufficient policy enforcement in Sandbox in Google Chrome on Linux prior to 149

Synopsis

This is an insufficient policy enforcement flaw in the sandbox component of Google Chrome on Linux, affecting all versions prior to 149.0.7827.53. The vulnerability is reachable over the network and requires no authentication, but does require the victim to visit a crafted HTML page. Successful exploitation gives a remote attacker the ability to escape Chrome's sandbox, enabling full read, write, and availability impact on the underlying host. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing the victim to a remote crafted HTML page, so the Chrome instance must be reachable via normal browser traffic.

• AuthenticationNot required

  No account credentials or prior authentication of any kind are needed to deliver the malicious page to the victim.

• Victim interactionRequired

  The victim must open or be redirected to a crafted HTML page, making this a social-engineering or malicious-link scenario.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental factors.

Blast Radius

• A successful sandbox escape lets the attacker execute arbitrary code outside the Chrome sandbox process, with the privileges of the browser's OS-level user account.
• Confidential data accessible to that user account, including files, session tokens, and credentials stored on disk, becomes readable.
• The attacker can write or modify files and persistent data within reach of the compromised user account.
• The attacker can crash or disrupt the browser process and any dependent services running under the same user context.