CVE-2026-10922: Insufficient validation of untrusted input in DevTools in Google Chrome prior to 149

Synopsis

Insufficient input validation in the DevTools component of Google Chrome (versions prior to 149.0.7827.53) allows a remote attacker to bypass the same-origin policy, a browser security boundary that prevents one site from reading data from another. The attack is reachable over the network but requires the attacker to trick a user into performing specific UI gestures, such as clicking through a crafted web page. Successful exploitation gives the attacker full read, write, and crash capabilities against the affected browsing context, enabling data theft, content tampering, and denial of service. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network; the target Chrome instance must be reachable via normal internet browsing.

• AuthenticationNot required

  No account or credential is needed; the attacker only needs the victim to visit or interact with a malicious page.

• Victim interactionRequired

  The victim must perform specific UI gestures (for example, clicking elements on a crafted page) as directed by the attacker, making social engineering a necessary part of the attack.

• Attack complexityDetail

  Attack complexity is Low, meaning the exploit is reliable and requires no special timing, race conditions, or environmental prerequisites beyond getting the victim to interact.

Blast Radius

• A successful attacker reads data from origins the victim is authenticated to, including session tokens, cookies, and page content that same-origin policy would normally protect.
• The attacker can write or modify content in the context of affected origins, enabling credential harvesting, form hijacking, or injecting malicious scripts.
• The attacker can crash or hang the affected browser process, disrupting the user's session and any active workloads running in that context.
• All three impact dimensions (confidentiality, integrity, availability) are rated High, meaning the attacker gains full effective control over the compromised browsing context.