CVE-2026-11296: Inappropriate implementation in ImageCapture in Google Chrome prior to 149

Synopsis

An inappropriate implementation flaw in the ImageCapture component of Google Chrome (versions prior to 149.0.7827.53) allows a remote attacker who has already compromised the renderer process to escalate privileges by serving a crafted HTML page. The vulnerability is reachable over the network but requires victim interaction and benefits from a pre-compromised renderer, making it a chained exploit rather than a standalone entry point. Successful exploitation gives the attacker high impact across confidentiality, integrity, and availability. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the victim over the network by serving a crafted HTML page, making over-the-network exposure a prerequisite.

• AuthenticationNot required

  No authentication is needed; the attacker does not need any account on the target system to initiate the attack.

• Victim interactionRequired

  The victim must visit or interact with a crafted HTML page, introducing a social-engineering step that the attacker must clear.

• Attack complexityDetail

  Attack complexity is high, meaning the attacker depends on a pre-compromised renderer process as a prerequisite condition before privilege escalation is possible.

Blast Radius

• A successful attacker reads sensitive data accessible to the elevated process, including credentials, tokens, or private user content.
• The attacker modifies data or browser state beyond normal renderer permissions, potentially altering stored settings or injecting content.
• The attacker disrupts or crashes affected browser processes, causing service loss for the victim.