CVE-2026-11640: Integer overflow in libyuv in Google Chrome prior to 149

Synopsis

An integer overflow in libyuv, the YUV image-processing library bundled with Google Chrome, allows a remote attacker who has already compromised the Chrome renderer process to escape the browser sandbox. The attack is delivered over the network by convincing a user to visit a crafted HTML page, and no authentication is required, though exploiting the flaw requires a prior renderer compromise and favorable conditions. Successful exploitation grants the attacker full code execution outside the sandbox, with high impact on confidentiality, integrity, and availability. A patched-image rebuild at Chrome 149.0.7827.103 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the victim's browser over the network, delivering the crafted HTML page via a standard web request.

• AuthenticationNot required

  No account credentials or session are needed; any user browsing to the attacker-controlled page is a viable target.

• Victim interactionRequired

  The victim must navigate to or be redirected to a crafted HTML page, making social engineering or a malicious ad/link the delivery mechanism.

• Attack complexityDetail

  Attack complexity is high; successful exploitation depends on the attacker having already compromised the renderer process and on meeting specific environmental or timing conditions to trigger the integer overflow for a sandbox escape.

Blast Radius

• A successful sandbox escape lets the attacker execute arbitrary code at the privilege level of the Chrome browser process on the host, breaking out of the renderer's security boundary.
• The attacker gains read access to files and data accessible to the browser process, including stored credentials, cookies, and session tokens outside the sandbox.
• The attacker can write to or modify files and system state accessible by the browser process, enabling persistence or lateral movement on the host.
• The Chrome process and dependent services can be crashed or made unavailable, disrupting the user's session and any browser-hosted workloads.