CVE-2026-10917: Insufficient validation of untrusted input in Media in Google Chrome prior to 149

Synopsis

This is an insufficient input validation vulnerability in the Media component of Google Chrome prior to version 149.0.7827.53. The flaw is reachable over the network and requires no authentication, but does require the attacker to have already compromised the Chrome renderer process and to trick a victim into visiting a crafted HTML page. Successful exploitation enables a sandbox escape, giving the attacker access beyond the browser's isolation boundary with high impact to confidentiality, integrity, and availability. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted HTML page over the network, so the target service or user must be reachable from the attacker's position on the internet.

• AuthenticationNot required

  No account or credential is needed to initiate the attack; the attacker only needs to lure a victim to a malicious page.

• Victim interactionRequired

  The victim must visit a crafted HTML page, meaning the attacker depends on a social-engineering step to get the user to navigate to or load the malicious content.

• Attack complexityDetail

  Attack complexity is HIGH because the attacker must first have compromised the Chrome renderer process before the sandbox escape becomes reachable, introducing a significant precondition beyond the attacker's direct control.

Blast Radius

• A successful sandbox escape breaks out of Chrome's process isolation, exposing the underlying host OS to attacker-controlled code execution.
• The attacker gains read access to files, credentials, and data outside the browser sandbox on the compromised host.
• The attacker can write or modify files and system state on the host, enabling persistence or lateral movement.
• The attacker can crash or destabilize host-level processes, disrupting availability of the system beyond just the browser tab.