CVE-2026-11655: Chrome macOS Sandbox Escape via Integer Overflow

Technical summary

CVE-2026-11655 is an integer overflow vulnerability (CWE-472) in Chrome's media processing subsystem on macOS. The flaw occurs prior to version 149.0.7827.103 and enables a post-compromise sandbox escape. The vulnerability requires an attacker to first control the renderer process—typically through a separate code execution bug—then deliver a malicious HTML page that triggers the integer overflow during media parsing. Successful exploitation breaks Chrome's sandbox isolation, granting access to system resources normally protected by the sandbox boundary.

Business impact

While this vulnerability requires a prior renderer compromise, successful exploitation eliminates a critical last line of defense in Chrome's multi-layer security model. For organizations where employees use Chrome on macOS, a successful attack chain could lead to credential theft, lateral network movement, or system takeover. The sandbox escape transforms a contained browser compromise into a full device compromise, significantly expanding attacker capabilities and potential organizational impact.

Affected systems

Google Chrome on macOS systems running versions prior to 149.0.7827.103 are vulnerable. Apple macOS is listed as an affected platform, though the vulnerability is specific to Chrome's media handling rather than macOS itself. Users running Chrome 149.0.7827.103 or later on any supported macOS version are not affected by this particular issue.

Exploitability

Exploitation requires two conditions: (1) the attacker must first compromise Chrome's renderer process through a separate vulnerability or technique, and (2) the victim must then visit or be directed to a malicious webpage containing the crafted HTML. While the CVSS score of 8.3 reflects high severity, the practical exploitability is constrained by the need for prior renderer access. This is a sandbox escape rather than an entry-point vulnerability, making it a secondary stage in a multi-stage attack. No public exploit code or KEV designation currently exists for this vulnerability.

Remediation

Update Google Chrome to version 149.0.7827.103 or later on all macOS systems. Chrome's auto-update mechanism will typically handle this, but verification is recommended for organizational deployments. Organizations managing Chrome through centralized policies should verify the update deployment across their macOS fleet. No workarounds exist short of disabling Chrome or running on non-macOS platforms.

Patch guidance

Chrome users should ensure automatic updates are enabled in Chrome Settings > About > Google Chrome, which will update to 149.0.7827.103 automatically and prompt for restart. Enterprise administrators should verify deployment of version 149.0.7827.103 or later through their Mobile Device Management (MDM) solution or Chrome Enterprise policies. After patching, no further action is required. The patch addresses the integer overflow directly without requiring configuration changes.

Detection guidance

Look for Chrome crash logs or system logs indicating media processing failures on macOS systems prior to version 149.0.7827.103, which may indicate exploitation attempts. Monitor for suspicious process spawning from Chrome or chrome helper processes, as successful sandbox escape may be followed by process creation outside the sandbox. Endpoint detection systems should flag unexpected child processes spawned by Chrome or its renderer processes. Network detection is difficult since exploitation relies on client-side rendering of malicious HTML; focus detection efforts on post-exploitation indicators such as unexpected system calls or process creation chains.

Why prioritize this

Despite the 8.3 CVSS score, prioritization should account for the attack prerequisite. Organizations should prioritize this alongside other Chrome vulnerabilities to maintain a strong sandbox boundary, but this is not an immediate entry-point risk. For macOS environments where Chrome is widely deployed, patching should occur within standard security update cycles (typically 1-2 weeks). If other active Chrome vulnerabilities are being exploited in your threat environment, prioritization should move to 3-5 days to close the chain that could enable sandbox escape.

Risk score, explained

The CVSS 3.1 score of 8.3 (HIGH) reflects: network attack vector (AV:N) since exploitation occurs via webpage delivery, high complexity (AC:H) due to the need for prior renderer compromise and specific conditions to trigger the overflow, no privilege requirement (PR:N), user interaction required (UI:R) to visit the malicious page, and changed scope (S:C) with high impact on confidentiality, integrity, and availability (C:H/I:H/A:H). The high score appropriately emphasizes the severity of a successful sandbox escape, though the prerequisite renderer compromise is reflected in the attack complexity factor.

Frequently asked questions