CVE-2026-11299 Overview
CVE-2026-11299 is an integer overflow vulnerability in the Fonts component of Google Chrome versions prior to 149.0.7827.53. The flaw allows a remote attacker to read potentially sensitive information from the browser process memory by serving a crafted HTML page to a victim. Exploitation requires user interaction, specifically that the target visits an attacker-controlled web page. Chromium classifies the security severity as Low, while the National Vulnerability Database (NVD) rates the issue at Medium with a CVSS score of 6.5. The vulnerability is tracked under [CWE-190] Integer Overflow and [CWE-125] Out-of-Bounds Read, reflecting how the arithmetic flaw leads to memory disclosure.
Critical Impact
Remote attackers can disclose sensitive Chrome process memory contents through a crafted HTML page, exposing data that may include tokens, cookies, or other in-memory secrets.
Affected Products
- Google Chrome versions prior to 149.0.7827.53
- Chrome on Microsoft Windows, Apple macOS, and Linux desktop platforms
- Chromium-based downstream builds incorporating the vulnerable Fonts code path
Discovery Timeline
- 2026-06-05 - CVE-2026-11299 published to NVD
- 2026-06-09 - Last updated in NVD database
Technical Details for CVE-2026-11299
Vulnerability Analysis
The vulnerability resides in the Fonts subsystem of Google Chrome, where an integer overflow during font data processing leads to an out-of-bounds read. When Chrome parses a maliciously crafted font referenced or embedded by an HTML page, an arithmetic computation wraps around an integer boundary. The resulting undersized or miscalculated value is then used to bound a memory read operation. Because the read extends beyond the intended buffer, adjacent process memory is exposed to the rendering logic and can be reflected back to attacker-controlled JavaScript or returned through side channels in the page.
The issue impacts confidentiality only. It does not corrupt memory or alter execution flow, which aligns with the Chromium project's Low internal rating. However, leaked memory can include sensitive structures such as authentication tokens, session cookies cached in renderer memory, address space layout data useful for chaining exploits, or content from cross-origin documents.
Root Cause
The root cause is unchecked arithmetic on size or offset values within the Fonts component, classified as [CWE-190]. The overflow produces a smaller-than-expected allocation or boundary value, which downstream code trusts when performing a memory read. The resulting out-of-bounds read is captured by [CWE-125]. Both weaknesses are common in C++ font parsers that operate on untrusted binary data.
Attack Vector
Exploitation is network-based and requires user interaction. An attacker hosts a web page that references or embeds a crafted font file. When a victim using an unpatched Chrome build loads the page, the renderer processes the malformed font and triggers the overflow. The attacker then uses scripting on the same page to extract leaked memory contents. No privileges or prior access are required on the target system.
No verified public proof-of-concept code is available for CVE-2026-11299. Technical details on the underlying fix are tracked in Chromium Issue Tracker #502598424.
Detection Methods for CVE-2026-11299
Indicators of Compromise
- Chrome renderer processes crashing or generating unexpected memory access events while loading pages containing custom @font-face resources.
- Outbound requests from browsers to recently registered or low-reputation domains hosting .ttf, .otf, .woff, or .woff2 files.
- JavaScript on suspicious pages performing large reads of CanvasRenderingContext2D text metrics or OffscreenCanvas pixel data shortly after font load.
Detection Strategies
- Inventory installed Chrome versions across the fleet and flag any build earlier than 149.0.7827.53 as vulnerable.
- Inspect web proxy and DNS logs for requests to font files served from unverified origins, particularly when paired with HTML pages from the same host.
- Correlate browser crash telemetry with URL history to identify pages that may be probing the Fonts code path.
Monitoring Recommendations
- Enable browser security event forwarding to a central logging platform and alert on repeated renderer crashes tied to font parsing.
- Monitor endpoint EDR telemetry for Chrome child processes exhibiting anomalous read patterns or memory access violations.
- Track Chrome auto-update status to confirm that managed endpoints have applied stable channel 149.0.7827.53 or later.
How to Mitigate CVE-2026-11299
Immediate Actions Required
- Update Google Chrome to version 149.0.7827.53 or later on Windows, macOS, and Linux endpoints.
- Restart all Chrome instances after the update to ensure the patched binary is loaded into memory.
- Push the update through enterprise management tooling such as Chrome Browser Cloud Management or platform MDM policies to enforce compliance.
Patch Information
Google addressed CVE-2026-11299 in the Chrome Stable channel release 149.0.7827.53. Details are published in the Google Chrome Stable Update announcement. Chromium-based browsers including Microsoft Edge, Brave, and Opera should be updated to releases that incorporate the equivalent upstream fix.
Workarounds
- Restrict navigation to untrusted sites using web filtering or DNS-layer controls until patching is complete.
- Disable web fonts through enterprise policy where business workflows permit, reducing exposure to the vulnerable Fonts parser.
- Apply site isolation and strict same-origin policy settings to limit the value of any leaked renderer memory.
# Verify the installed Chrome version on Linux endpoints
google-chrome --version
# Force an update check on managed Windows hosts
"%ProgramFiles%\Google\Chrome\Application\chrome.exe" --check-for-update-interval=1
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
