CVE-2026-12018: Inappropriate implementation in Mojo in Google Chrome on Windows prior to 149

Synopsis

An inappropriate implementation flaw in Mojo, the inter-process communication layer of Google Chrome on Windows, allows a local attacker to escalate privileges to the operating system level by convincing a user to open a malicious file. The CVSS vector reflects a network-delivered attack requiring user interaction but no authentication, with high impact across confidentiality, integrity, and availability. Successful exploitation gives the attacker elevated OS privileges, enabling full control over the affected host. A patched-image rebuild at version 149.0.7827.115 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the malicious file over the network, requiring the target service or user to be reachable from the attacker's position.

• AuthenticationNot required

  No account or credentials are needed; the attack can be launched by any unauthenticated party who can deliver a file to the target.

• Victim interactionRequired

  The target user must open or interact with the attacker-supplied malicious file, making social engineering the primary delivery mechanism.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other hard-to-control environmental factors.

Blast Radius

• A successful attacker gains OS-level elevated privileges on the affected Windows host, bypassing the Chrome sandbox boundary.
• With elevated privileges, the attacker can read any files, credentials, or secrets accessible to higher-privileged processes on the system.
• The attacker can write to or modify protected system files, installed software, and persisted data on the host.
• The attacker can terminate processes, install persistent malware, or render the host inoperable, causing full service disruption.