CVE-2026-11667: Out of bounds read in WebRTC in Google Chrome prior to 149

Synopsis

An out-of-bounds read vulnerability in the WebRTC component of Google Chrome prior to version 149.0.7827.103 allows a remote attacker who has already compromised the GPU process to trigger heap corruption. The attack requires the victim to visit a crafted HTML page and is reachable over the network, though it requires no authentication and exploiting it involves meaningful complexity around prior GPU process compromise. Successful exploitation gives the attacker full read, write, and availability impact on the affected process, enabling data theft, data tampering, and service disruption. A patched-image rebuild at version 149.0.7827.103 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the victim over the network by serving or directing them to a crafted HTML page hosted remotely.

• AuthenticationNot required

  No account credentials or prior authentication to the target service are needed to deliver the exploit.

• Victim interactionRequired

  The victim must navigate to or load a crafted HTML page, making this a social-engineering vector that requires the attacker to lure the user.

• Attack complexityDetail

  Exploitation is rated High complexity because the attacker must first have compromised the Chrome GPU process before the out-of-bounds read can be leveraged for heap corruption.

Blast Radius

• A successful attacker reads arbitrary heap memory from the compromised Chrome process, exposing in-memory session tokens, credentials, and page content.
• The attacker writes to heap memory, allowing modification of internal Chrome process state and potentially injecting malicious data into rendered content.
• The heap corruption can crash the affected Chrome process, disrupting the user's browsing session and any web-based application running within it.
• Because Confidentiality, Integrity, and Availability are all rated High, the attacker achieves broad control over the compromised renderer context.