CVE-2026-11689: Insufficient policy enforcement in Passwords in Google Chrome prior to 149

Synopsis

This is an insufficient policy enforcement vulnerability in Google Chrome's password subsystem, affecting all versions prior to 149.0.7827.103. A remote attacker who has already compromised the Chrome renderer process can exploit it by delivering a crafted HTML page, bypassing site isolation without needing any authentication. Successful exploitation gives the attacker high-confidence read access to stored credentials and the ability to tamper with password data across origins that site isolation is meant to keep separate. A patched-image rebuild at version 149.0.7827.103 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the victim over the network, typically by serving a crafted HTML page from a remote host.

• AuthenticationNot required

  No credentials or account are needed; the attacker requires only that the victim's renderer process has already been compromised before this step.

• Victim interactionRequired

  The victim must load or interact with the attacker's crafted HTML page, making this a social-engineering-dependent attack.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit does not depend on race conditions or specific memory layout and can be executed reliably once the renderer is compromised.

Blast Radius

• Reads stored passwords and credentials protected by site isolation across origins the attacker should not be able to access.
• Modifies or corrupts password data persisted in Chrome's password store, potentially planting or altering saved credentials.
• Bypasses the site isolation boundary, allowing cross-origin data from sensitive domains to be exfiltrated through the compromised renderer.
• Availability is not impacted; the service continues running while the credential theft or tampering occurs silently.