CVE-2026-12027: Inappropriate implementation in Headless in Google Chrome prior to 149

Synopsis

This is a sandbox escape vulnerability in the Headless component of Google Chrome versions prior to 149.0.7827.115. An attacker who has already compromised the Chrome renderer process can exploit an inappropriate implementation flaw by serving the victim a crafted HTML page, delivered over the network with no authentication required but needing the victim to visit a malicious page. Successful exploitation breaks out of the Chrome sandbox, giving the attacker full access to the underlying host process with high impact to confidentiality, integrity, and availability. A patched-image rebuild at version 149.0.7827.115 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the victim over the network, either by hosting a malicious page the victim browses to or by injecting content into an existing browsing session.

• AuthenticationNot required

  No account or credentials are needed; any unauthenticated remote attacker who can direct the victim to a crafted page can attempt the exploit.

• Victim interactionRequired

  The victim must visit or be redirected to the attacker-controlled HTML page, making this a social-engineering or drive-by vector that requires at least one user action.

• Attack complexityDetail

  Attack complexity is Low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other variable environmental factors once the renderer is compromised.

Blast Radius

• Reads any data accessible to the Chrome process on the host, including stored credentials, session cookies, and files reachable by the browser's OS user.
• Writes or modifies files and data accessible to that OS user, enabling persistence mechanisms or tampering with local application state.
• Crashes or destabilizes the host process and any co-located services sharing the same execution environment.
• Provides a foothold for lateral movement within the container or host, since sandbox containment no longer applies after a successful escape.