CVE-2026-11690: Out of bounds read and write in Media in Google Chrome on Mac prior to 149

Synopsis

Out-of-bounds read and write vulnerability in the Media component of Google Chrome on macOS affects all Chrome versions prior to 149.0.7827.103. The flaw is reachable over the network and requires no authentication, but the attacker must have already compromised the renderer process and needs the victim to interact with a crafted HTML page. Successful exploitation allows arbitrary code execution inside the browser sandbox, giving the attacker a foothold for further privilege escalation. A patched-image rebuild at version 149.0.7827.103 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network, requiring the victim's browser to reach or receive a crafted HTML page from a remote source.

• AuthenticationNot required

  No account or credential is needed; the attack is initiated by an unauthenticated remote party.

• Victim interactionRequired

  The victim must open or be redirected to a crafted HTML page, making social engineering or a malicious link a prerequisite.

• Attack complexityDetail

  Exploitation is rated high complexity because the attacker must have already compromised the renderer process before leveraging this bug, introducing a significant prerequisite condition.

Blast Radius

• Executes arbitrary code inside the Chrome sandbox on the victim's Mac, giving the attacker control of the sandboxed renderer process.
• Reads memory contents of the renderer process, which may include session tokens, cached credentials, or page data from visited sites.
• Writes to out-of-bounds memory regions, enabling corruption of renderer state that can be leveraged as a stepping stone for sandbox-escape exploits.
• Combines high confidentiality, integrity, and availability impact, meaning the attacker can read sensitive data, tamper with rendered content, and crash the affected browser process.