CVE-2026-10897: Inappropriate implementation in GPU in Google Chrome prior to 149

Synopsis

An inappropriate GPU implementation flaw in Google Chrome prior to version 149.0.7827.53 allows a remote attacker to trigger a sandbox escape through a crafted HTML page. The vulnerability is reachable over the network and requires no authentication, though a victim must visit a malicious or attacker-controlled page. Successful exploitation breaks out of Chrome's sandbox, giving the attacker code execution capability beyond normal browser process boundaries. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by luring a victim to a crafted HTML page, so the affected service must be reachable from an internet-facing or network-connected browser session.

• AuthenticationNot required

  No credentials or account are needed; any unauthenticated user browsing to a malicious page is a viable target.

• Victim interactionRequired

  The victim must open or be redirected to a crafted HTML page, making this a social-engineering or drive-by delivery scenario.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other unpredictable environmental factors.

Blast Radius

• Attacker escapes the Chrome renderer sandbox and gains code execution in the context of the browser process on the victim host.
• Confidential data accessible to the browser process, including stored credentials, session tokens, and local files within reach of that process, can be read.
• The attacker can write or modify files and browser state accessible to the compromised process, enabling persistence or further lateral movement.
• The affected browser process can be crashed or made unavailable, disrupting the user's session and any browser-based workflows.