CVE-2026-10904: Inappropriate implementation in V8 in Google Chrome prior to 149

Synopsis

This is a sandbox-contained arbitrary code execution flaw in the V8 JavaScript engine used by Google Chrome prior to version 149.0.7827.53. The vulnerability is reachable over the network and requires no authentication, but does require a victim to visit a crafted HTML page. Successful exploitation gives an attacker arbitrary code execution within the Chrome sandbox. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing or luring the victim to a crafted HTML page served from a remote host.

• AuthenticationNot required

  No account or credential of any kind is required; the attack works against any unauthenticated browser session.

• Victim interactionRequired

  The victim must navigate to or be redirected to the attacker-controlled HTML page, making this a social-engineering or malicious-ad delivery scenario.

• Attack complexityDetail

  Exploit complexity is low: no race conditions, memory layout dependencies, or special environmental conditions must be met for the exploit to succeed reliably.

Blast Radius

• Attacker executes arbitrary code inside the Chrome renderer sandbox, gaining full control of the sandboxed process.
• Confidential data processed by the browser tab (session tokens, form inputs, page content) is readable by the attacker.
• The attacker can write or modify data within the sandbox's accessible scope, including cached credentials and local storage tied to the renderer.
• The affected renderer process can be crashed or destabilized, disrupting the user's browser session.