CVE-2026-12016: Inappropriate implementation in DevTools in Google Chrome prior to 149

Synopsis

This is a sandbox escape vulnerability in Google Chrome's DevTools component affecting versions prior to 149.0.7827.115. The flaw is reachable over the network but requires the attacker to have already compromised the renderer process and to trick a user into visiting a crafted HTML page. Successful exploitation allows an attacker to break out of the Chrome sandbox, gaining the ability to read data, modify files, and execute code at a higher privilege level on the host. A patched-image rebuild at version 149.0.7827.115 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must deliver a crafted HTML page to the victim over the network, so the Chrome instance must be reachable or the user must browse to attacker-controlled content.

• AuthenticationNot required

  No account or credential is needed; the attack is launched through a crafted page accessible to any unauthenticated visitor.

• Victim interactionRequired

  The victim must open or be redirected to a crafted HTML page, making this a social-engineering or drive-by delivery scenario.

• Attack complexityDetail

  Exploitation is rated High complexity because the attacker must first have compromised the renderer process before leveraging this flaw for a sandbox escape, introducing a meaningful prerequisite step.

Blast Radius

• Attacker breaks out of the Chrome sandbox and gains code execution in the context of the browser process on the host.
• Confidential data accessible to the browser process, including stored credentials, cookies, and local files, becomes readable.
• The attacker can write or modify files on the host filesystem at the privilege level of the browser process.
• The host process can be crashed or made unavailable, disrupting the user's session and any services depending on the browser component.