CVE-2026-10910: Type Confusion in V8 in Google Chrome prior to 149

Synopsis

A type confusion vulnerability in V8, the JavaScript engine embedded in Google Chrome, allows a remote attacker to execute arbitrary code inside the browser sandbox by tricking a user into visiting a crafted HTML page. The vulnerability is reachable over the network and requires no authentication, but does require the victim to open a malicious page. Successful exploitation grants the attacker code execution within the Chrome sandbox, which can be leveraged as a stepping stone toward full system compromise. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network; the victim's browser must be able to reach the attacker-controlled or compromised web page.

• AuthenticationNot required

  No account or credential of any kind is required; any anonymous visitor to a malicious page is a valid target.

• Victim interactionRequired

  The victim must open a crafted HTML page in the browser, making this a social-engineering vector that depends on the user navigating to or being redirected to the attacker's page.

• Attack complexityDetail

  Exploit reliability is high: no race conditions, memory-layout assumptions, or special environmental factors are required once the victim loads the page.

Blast Radius

• The attacker gains arbitrary code execution within the Chrome renderer sandbox, enabling JavaScript engine-level control over the affected browser process.
• Confidential data processed by the browser, including session tokens, form data, and page contents, is exposed to the attacker.
• The attacker can modify in-browser state, redirect navigation, and inject content into pages the victim is viewing.
• A sandbox escape chained onto this vulnerability would extend attacker control to the underlying host operating system.