CVE-2026-10017: Out of bounds read in Headless in Google Chrome prior to 148

Synopsis

An out-of-bounds read vulnerability exists in the Headless component of Google Chrome versions prior to 148.0.7778.216. The flaw is reachable over the network but requires an attacker who has already compromised the Chrome renderer process to deliver a crafted HTML page to the victim. Successful exploitation enables a sandbox escape, giving the attacker elevated access outside the Chrome sandbox with high impact to confidentiality, integrity, and availability. A patched-image rebuild at version 148.0.7778.216 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the target over the network, delivering a crafted HTML page to a victim running an affected Chrome version.

• AuthenticationNot required

  No authentication or account credentials are required to stage the attack; the attacker only needs the victim to load a crafted page.

• Victim interactionRequired

  The victim must interact with attacker-controlled content, such as visiting or being directed to a crafted HTML page, making social engineering a prerequisite.

• Attack complexityDetail

  Attack complexity is high, meaning the attacker must have already compromised the Chrome renderer process before this vulnerability can be leveraged for a sandbox escape.

Blast Radius

• A successful attacker escapes the Chrome sandbox and gains execution context outside its isolation boundary.
• With high confidentiality impact, the attacker reads data accessible to the browser process, including stored credentials, session tokens, and page content from other origins.
• With high integrity impact, the attacker modifies files, browser state, or data reachable by the browser process on the host.
• With high availability impact, the attacker disrupts or crashes the browser process or dependent host services.