CVE-2026-11693: Inappropriate implementation in Plugins in Google Chrome prior to 149

Synopsis

This is a security-boundary bypass in Google Chrome's plugin handling, present in all versions before 149.0.7827.103. An attacker must lure the victim to a crafted HTML page, and must have already compromised Chrome's renderer process; from there the flaw lets them break site isolation, the mechanism that keeps different websites' data separated in memory. Successful exploitation gives the attacker read access to data belonging to other origins and the ability to tamper with cross-origin content. A patched-image rebuild at 149.0.7827.103 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted HTML page over the network, so the victim's browser must be able to reach attacker-controlled content.

• AuthenticationNot required

  No account or credential is needed; any unauthenticated remote attacker can serve the malicious page.

• Victim interactionRequired

  The victim must navigate to or be redirected to the attacker's crafted HTML page, making this a social-engineering or phishing-dependent attack.

• Attack complexityDetail

  The exploit itself is condition-free and reliable once the renderer is compromised, though obtaining that renderer compromise is a prerequisite that adds real-world difficulty.

Blast Radius

• The attacker reads sensitive data belonging to other origins loaded in the browser, such as session tokens, form contents, and cached responses from third-party sites.
• The attacker modifies cross-origin content rendered in the browser, enabling credential-harvesting overlays or script injection into trusted pages.
• Site isolation is fully bypassed, so every tab or iframe sharing the same browser process becomes accessible to the attacker's renderer-level code.