CVE-2026-10924: Integer overflow in Chromecast in Google Chrome prior to 149

Synopsis

An integer overflow in the Chromecast component of Google Chrome before version 149.0.7827.53 allows a remote attacker who has already compromised the renderer process to escape the browser sandbox via a crafted HTML page. The vulnerability is reachable over the network but requires the victim to interact with a malicious page, and exploitation depends on non-trivial environmental factors given the high attack complexity rating. Successful exploitation gives the attacker full confidentiality, integrity, and availability impact outside the sandbox boundary, effectively achieving code execution at a higher privilege level. A patched-image rebuild at 149.0.7827.53 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the victim's browser over the network, typically by hosting or injecting a crafted HTML page that the victim navigates to.

• AuthenticationNot required

  No authentication is needed; the attacker does not need any account or credential on the target system.

• Victim interactionRequired

  The victim must visit or be directed to a crafted HTML page, making this a social-engineering-dependent attack vector.

• Attack complexityDetail

  Attack complexity is rated High, meaning exploitation depends on additional preconditions beyond the attacker's direct control, specifically that the renderer process must already be compromised before the sandbox escape can be attempted.

Blast Radius

• A successful attacker reads data accessible outside the Chrome sandbox, including stored credentials, session tokens, and files on the host filesystem.
• The attacker can write or modify data on the host, including user files and persistent application state outside the browser's normal isolation boundary.
• The attacker can crash or destabilize host-level processes, causing service disruption beyond the browser tab or profile.
• Because scope is changed (S:C in the CVSS vector), impact extends beyond the vulnerable component itself, meaning the attacker gains capabilities in the broader host environment, not just within Chrome.