CVE-2026-11662: Type Confusion in Bindings in Google Chrome prior to 149

Synopsis

A type confusion vulnerability in the Bindings layer of Google Chrome prior to version 149.0.7827.103 allows a remote attacker to execute arbitrary code inside the browser sandbox. The vulnerability is reachable over the network and requires no authentication, but the victim must visit a crafted HTML page. Successful exploitation gives the attacker arbitrary code execution within the Chrome sandbox, which can be chained with a sandbox escape to achieve broader compromise. A patched-image rebuild at 149.0.7827.103 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing the victim to a crafted HTML page hosted remotely.

• AuthenticationNot required

  No account or credentials are needed; any unauthenticated remote attacker can attempt the exploit.

• Victim interactionRequired

  The victim must visit or be redirected to a crafted HTML page, making this a social-engineering or drive-by delivery scenario.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other unpredictable environmental factors.

Blast Radius

• The attacker achieves arbitrary code execution inside the Chrome renderer sandbox.
• Confidential data accessible to the renderer, such as page content, stored credentials, and session tokens visible to the browser process, can be read.
• The attacker can modify in-page data and interact with web origins loaded in the compromised renderer.
• A successful sandbox escape chained to this vulnerability would grant full access to the underlying host user account and its files and processes.