CVE-2026-10022: Type Confusion in V8 in Google Chrome prior to 148

Synopsis

A type confusion vulnerability in V8, the JavaScript engine used by Google Chrome, affects all Chrome versions before 148.0.7778.216. The flaw is reachable over the network but requires a victim to install a malicious Chrome extension, and no special account privileges are needed on the attacker's side. Successful exploitation allows arbitrary code execution inside Chrome's sandbox, meaning an attacker gains code execution within the browser process boundary. A patched-image rebuild at version 148.0.7778.216 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the malicious extension over the network, so the victim's browser must be reachable in the sense that the user browses to or is directed toward attacker-controlled content.

• AuthenticationNot required

  No account or credentials on the target system are required; the attacker needs only to convince the user to install a crafted extension.

• Victim interactionRequired

  The victim must actively install a malicious Chrome extension, making this a social-engineering vector that requires deliberate user action.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other variable environmental factors.

Blast Radius

• An attacker executes arbitrary code within the Chrome renderer sandbox, gaining full control of the browser process context.
• Sandboxed code execution allows reading of in-browser session tokens, saved credentials, and page content from any open tab.
• The attacker can modify in-browser state, inject content into pages, and exfiltrate data silently during the browsing session.
• While the sandbox limits direct OS access, a sandbox escape chained with this bug would give the attacker full host-level code execution.