CVE-2026-12034: Insufficient validation of untrusted input in Linux Toolkit Theming in Google Chrome on Linux prior to 149

Synopsis

Insufficient input validation in the Linux Toolkit Theming component of Google Chrome on Linux allows a remote attacker who has already compromised the renderer process to escape the browser sandbox. The attack requires network reachability, no prior authentication, a user interaction step, and high attack complexity due to the prerequisite renderer compromise. Successful exploitation gives the attacker full read, write, and crash capability outside the sandbox, effectively achieving arbitrary code execution on the host. A patched-image rebuild at version 149.0.7827.115 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the target over the network, as the initial attack vector is remote delivery of a malicious file to the victim's browser.

• AuthenticationNot required

  No account or credentials are needed; the attacker operates as an unauthenticated remote party.

• Victim interactionRequired

  The victim must take an action such as opening or interacting with a malicious file, making social engineering a prerequisite step.

• Attack complexityDetail

  Exploitation is high complexity because the attacker must have already compromised the Chrome renderer process before this vulnerability can be used for sandbox escape.

Blast Radius

• Reads arbitrary files and memory outside the Chrome sandbox on the host system, including credentials, session tokens, and user data.
• Writes or modifies files on the host filesystem with the permissions of the Chrome process user.
• Crashes the browser process or dependent host services by corrupting process state outside the sandbox.
• Achieves a full sandbox escape, enabling further lateral movement or persistence on the underlying Linux host.