CVE-2026-11655: Integer overflow in Media in Google Chrome on Mac prior to 149

Synopsis

An integer overflow in the Media component of Google Chrome on macOS affects all versions prior to 149.0.7827.103. The vulnerability is reachable over the network but requires the attacker to have already compromised the renderer process and to trick a user into visiting a crafted HTML page; no credentials are needed. Successful exploitation enables a sandbox escape, giving the attacker code execution outside the browser sandbox with access to confidential data, the ability to modify system state, and the ability to disrupt the host. A patched-image rebuild at version 149.0.7827.103 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the target over the network by serving a crafted HTML page to the victim's browser.

• AuthenticationNot required

  No credentials or prior account access are needed; the attack is available to any remote party.

• Victim interactionRequired

  The victim must navigate to or be redirected to a crafted HTML page, requiring a social-engineering step.

• Attack complexityDetail

  Exploitation is high complexity; the attacker must have already compromised the renderer process before leveraging this overflow, introducing a meaningful environmental prerequisite.

Blast Radius

• Reads sensitive data from outside the Chrome sandbox, including stored credentials, session tokens, and files accessible to the browser process owner.
• Modifies files or system state outside the sandbox boundary on the affected macOS host.
• Crashes or disrupts services running on the host beyond the browser process itself.
• Achieves code execution in the context of the host OS user, enabling follow-on persistence or lateral movement.