CVE-2026-10928: Script injection in Headless in Google Chrome prior to 149

Synopsis

Script injection in the Headless component of Google Chrome (versions before 149.0.7827.53) allows a remote attacker to execute arbitrary code by delivering a crafted HTML page to a victim. The vulnerability is reachable over the network and requires no authentication, though it does require the victim to open the malicious page. Successful exploitation gives the attacker full code execution in the context of the browser process, enabling data theft, file system tampering, or complete session compromise. A patched-image rebuild at 149.0.7827.53 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the payload over the network; the target Chrome instance must be reachable or the victim must browse to an attacker-controlled page.

• AuthenticationNot required

  No account or credential of any kind is needed; the attack works against any unauthenticated browser session.

• Victim interactionRequired

  The victim must open a crafted HTML page, making social engineering (phishing link, malicious ad, redirected URL) the necessary delivery mechanism.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and imposes no special environmental preconditions or race conditions on the attacker.

Blast Radius

• Attacker executes arbitrary code in the browser process, gaining the same filesystem and network access the browser holds.
• Confidential data visible to the browser (session tokens, saved credentials, page contents) is readable by the attacker.
• Attacker can write or modify files accessible to the browser process, including cached data and locally stored application state.
• The browser process can be crashed or made unresponsive, disrupting any workflow or service that depends on the headless Chrome instance.