CVE-2026-11697: Insufficient validation of untrusted input in UI in Google Chrome prior to 149

Synopsis

Insufficient input validation in the Google Chrome browser UI allows a remote attacker to escape the browser sandbox via a crafted HTML page. The vulnerability is reachable over the network, requires no authentication, and needs only a single user interaction (visiting or being redirected to a malicious page). Successful exploitation grants the attacker full confidentiality, integrity, and availability impact beyond the browser sandbox, enabling code execution, data theft, or service disruption at the host level. A patched-image rebuild at version 149.0.7827.103 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by luring or redirecting the victim to a crafted HTML page hosted on an attacker-controlled server.

• AuthenticationNot required

  No account or credentials on any system are needed; any anonymous user can serve the malicious page.

• Victim interactionRequired

  The victim must visit or be redirected to the crafted HTML page, making this a social-engineering or drive-by delivery scenario.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no race condition, special memory layout, or other environmental precondition.

Blast Radius

• Attacker escapes the Chrome sandbox and executes arbitrary code in the context of the browser process on the host.
• Reads files, stored credentials, session tokens, and other sensitive data accessible to the browser or the host user account.
• Writes or modifies files and persistent data on the host, including browser profiles, downloaded files, and user directories.
• Crashes or disrupts the browser and any dependent services running under the same user context on the host.