CVE-2026-10015: Integer overflow in WTF in Google Chrome prior to 148

Synopsis

An integer overflow vulnerability in the WTF (Web Template Framework) component of Google Chrome prior to version 148.0.7778.216 allows a remote attacker to execute arbitrary code inside the browser sandbox by delivering a crafted HTML page to a victim. The attack requires no authentication but does require the victim to visit or be redirected to a malicious page, and is reachable over the network. Successful exploitation gives the attacker code execution within the Chrome sandbox, which can be chained with a sandbox escape for deeper system access. A patched-image rebuild at version 148.0.7778.216 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing the victim to a crafted HTML page, so the Chrome instance must be reachable in the sense that the victim can browse to an attacker-controlled or compromised URL.

• AuthenticationNot required

  No authentication or account credentials are needed; any unauthenticated user who visits the malicious page is a valid target.

• Victim interactionRequired

  The victim must open or be redirected to a crafted HTML page, making this a social-engineering or drive-by delivery scenario.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental preconditions.

Blast Radius

• The attacker executes arbitrary code inside the Chrome renderer sandbox, gaining the ability to run attacker-supplied instructions within that process.
• Confidentiality impact is high: the attacker reads data accessible to the renderer, including page content, stored credentials exposed to the browser context, and session tokens.
• Integrity impact is high: the attacker modifies data within the compromised renderer process, including DOM state and any data written back to storage APIs.
• Availability impact is high: the attacker crashes or hangs the affected browser process, disrupting the user's session and any dependent in-browser workflows.