CVE-2026-10935: Type Confusion in V8 in Google Chrome prior to 149

Synopsis

A type confusion vulnerability in V8, the JavaScript engine embedded in Google Chrome, allows a remote attacker to execute arbitrary code inside the browser sandbox by tricking a user into visiting a crafted HTML page. The vulnerability is reachable over the network and requires no authentication, but does require the victim to open a malicious page. Successful exploitation gives the attacker code execution within the Chrome sandbox, which can serve as a stepping stone to full system compromise. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by hosting a crafted HTML page that the victim's browser fetches remotely.

• AuthenticationNot required

  No account or credential is needed; any unauthenticated user who visits the malicious page is at risk.

• Victim interactionRequired

  The victim must navigate to or be redirected to a crafted HTML page, making this a social-engineering or drive-by delivery scenario.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental factors.

Blast Radius

• The attacker executes arbitrary code within the Chrome renderer sandbox, gaining control over the sandboxed process.
• Confidential data processed by the browser, including session tokens, saved credentials, and page content, is exposed to the attacker.
• The attacker can modify in-browser state and interact with web origins the victim is authenticated to, enabling data tampering through the browser.
• A successful sandbox escape following initial compromise would give the attacker full access to the host user account and its files.