CVE-2026-11301: Inappropriate implementation in LiveCaption in Google Chrome prior to 149

Synopsis

An inappropriate implementation flaw in the LiveCaption feature of Google Chrome prior to version 149.0.7827.53 allows a remote attacker to trigger out-of-bounds memory access by sending malicious network traffic to a victim. Exploitation requires the victim to interact with attacker-controlled content, but no authentication is needed on the attacker's side. Successful exploitation gives the attacker read access to sensitive memory, the ability to tamper with memory contents, and the ability to crash or destabilize the browser process. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers malicious network traffic to a victim over the internet, so the service must be reachable from the attacker's network position.

• AuthenticationNot required

  No account or credential is needed; the attacker can initiate the attack as an unauthenticated party.

• Victim interactionRequired

  The victim must interact with attacker-controlled content, such as visiting a crafted page or processing a malicious media stream, making social engineering a prerequisite.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental factors.

Blast Radius

• A successful attacker reads memory contents outside intended buffer boundaries, which exposes sensitive in-process data such as credentials, tokens, or cached page content.
• The attacker writes to or corrupts out-of-bounds memory, allowing modification of browser state or injected code paths.
• The attacker can crash the Chrome renderer or browser process, disrupting the victim's session and any dependent workloads.