CVE-2026-11677: Race in Network in Google Chrome on Mac prior to 149

Synopsis

A race condition in the network process component of Google Chrome on macOS (versions prior to 149.0.7827.103) allows a remote attacker who has already compromised the network process to escape the browser sandbox. The attack requires the victim to visit a crafted HTML page, is reachable over the network, and does not require any authentication. Successful exploitation gives the attacker full confidentiality, integrity, and availability impact outside the browser sandbox, effectively granting arbitrary code execution in the broader OS context. A patched-image rebuild at version 149.0.7827.103 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the victim over the network by delivering a crafted HTML page, meaning the service or user session must be accessible from a remote network location.

• AuthenticationNot required

  No account or credentials are needed; the attack is launched against an unauthenticated browsing session.

• Victim interactionRequired

  The victim must visit a crafted HTML page, requiring a social-engineering step such as a phishing link or malicious ad to trigger the race condition.

• Attack complexityDetail

  Attack complexity is high, meaning the attacker must win a race condition in the network process, which depends on precise timing and may require multiple attempts or favorable environmental conditions.

Blast Radius

• The attacker escapes the Chrome browser sandbox on macOS, gaining execution context outside the browser's isolation boundary.
• With sandbox escape achieved, the attacker reads files, credentials, and session tokens accessible to the user running Chrome.
• The attacker modifies files or OS-level persistent state, enabling malware installation or privilege escalation beyond the browser.
• The attacker can crash or disrupt processes running under the same user account, causing service disruption on the affected host.