CVE-2026-11660: Google Chrome New Tab Page Sandbox Escape (CVSS 8.3)

Technical summary

CVE-2026-11660 stems from insufficient input validation in the New Tab Page component of Chromium. An attacker must first compromise the renderer process—typically through a prior vulnerability in web content parsing or script execution. Once inside the sandbox, the attacker can exploit the validation weakness via a crafted HTML page to break out and gain system-level privileges. The vulnerability is classified as CWE-20 (Improper Input Validation) and carries a CVSS 3.1 score of 8.3 (High severity) with a complex attack vector (AC:H) but high impact across confidentiality, integrity, and availability.

Business impact

Sandbox escape vulnerabilities represent an existential threat to the security model of modern browsers. Successful exploitation allows an attacker to transition from web-based code execution to arbitrary system commands, potentially enabling data theft, malware installation, lateral movement to other systems, or complete device takeover. Organizations relying on browser isolation as a security control may find that protection layer neutralized. The requirement for prior renderer compromise limits immediate risk but does not eliminate it, as renderer vulnerabilities are regularly discovered.

Affected systems

Google Chrome versions prior to 149.0.7827.103 running on Windows, macOS, or Linux are affected. This includes all three major operating systems, making it a widespread concern. Users running Chrome 149.0.7827.103 or later are not vulnerable to this specific issue.

Exploitability

Exploitation requires two stages: first, the attacker must compromise the renderer process (typically via a separate vulnerability or social engineering), and second, they must serve a crafted HTML page to trigger the New Tab Page validation flaw. This two-stage requirement (AC:H) reduces opportunistic attack feasibility. However, because many renderer vulnerabilities are known or will be discovered, and because the New Tab Page is a frequently-visited surface, the overall risk remains substantial. The vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, but that does not indicate absence of active exploitation.

Remediation

Update Google Chrome to version 149.0.7827.103 or later. Chrome's auto-update mechanism will push this patch to most users, but organizations with managed deployments should verify rollout and enforce minimum version requirements. Verify the update has been applied by navigating to chrome://settings/help, which will display the current version and check for updates.

Patch guidance

Users: Enable automatic updates if not already active (Chrome default). Verify the running version is 149.0.7827.103 or higher via chrome://version. Organizations: Test patch compatibility in a non-production environment before enterprise rollout. Configure update policies to enforce minimum version 149.0.7827.103. Monitor for any reported issues in the deployed version and maintain a patch rollback plan. Prioritize this update given the High severity and sandbox escape risk.

Detection guidance

Monitor Chrome version inventory across your organization using endpoint management tools (MDM/EMM) or browser telemetry. Log and alert on attempts to access the New Tab Page with unusual or malformed HTML payloads if your network inspection tools support it. Endpoint detection systems should flag any Chrome process spawning unusual child processes or making unexpected system calls after New Tab Page rendering, which may indicate sandbox escape attempts. Review browser crash logs for instability in the New Tab Page rendering engine post-patch to confirm stability.

Why prioritize this

Sandbox escapes are among the most critical browser vulnerabilities because they nullify the primary security isolation mechanism of modern browsers. A successful exploit can lead to full system compromise. Although exploitation requires prior renderer compromise, the combination of a known attack surface (New Tab Page) and High severity warrants immediate patching. The absence from CISA KEV does not reduce urgency; it reflects current intelligence rather than absence of risk. Organizations should treat this as a mandatory patch within 1–2 weeks depending on their update cadence.

Risk score, explained

The CVSS 3.1 score of 8.3 reflects High severity due to the confluence of factors: High impact across all three security properties (confidentiality, integrity, availability), no authentication required, and user interaction needed (clicking or viewing a malicious page). The score is not Critical (9.0+) because exploitation requires prior compromise of the renderer process, which reduces the attack surface compared to direct remote code execution. However, the score appropriately emphasizes that the impact of successful exploitation—sandbox escape leading to system compromise—is severe.

Frequently asked questions