CVE-2026-11659: Integer overflow in UI in Google Chrome on Linux prior to 149

Synopsis

An integer overflow in the UI component of Google Chrome on Linux (versions prior to 149.0.7827.103) allows a remote attacker to trigger a sandbox escape by luring a user to a crafted HTML page. The vulnerability is reachable over the network with no authentication required, though the attacker must induce the victim to visit a malicious page. Successful exploitation gives the attacker full confidentiality, integrity, and availability impact outside the Chrome sandbox, effectively enabling remote code execution on the host. A patched-image rebuild at version 149.0.7827.103 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing the victim to a remotely hosted crafted HTML page, so the Chrome instance must be reachable in a browsing context exposed to attacker-controlled content.

• AuthenticationNot required

  No account or credential is needed; the attacker only needs the victim to open a URL.

• Victim interactionRequired

  The victim must visit a crafted HTML page, meaning the attacker must use phishing, malicious ads, or another social-engineering vector to get the user to browse to the page.

• Attack complexityDetail

  Attack complexity is Low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental factors beyond victim interaction.

Blast Radius

• The attacker escapes the Chrome renderer sandbox and gains code execution in the context of the browser process on the Linux host.
• With sandbox escape achieved, the attacker reads files and secrets accessible to the user running Chrome, including stored credentials, session cookies, and local application data.
• The attacker can write or modify files on the host filesystem within the user's permissions, enabling persistence or tampering with other applications.
• The attacker can crash or destabilize the browser process and any dependent services, causing a denial of service for the affected user session.