CVE-2026-10936: Type Confusion in V8 in Google Chrome prior to 149

Synopsis

A type confusion vulnerability in V8, the JavaScript engine embedded in Google Chrome prior to version 149.0.7827.53, allows a remote attacker to execute arbitrary code inside the browser sandbox by luring a victim to a crafted HTML page. The attack is reachable over the network and requires no authentication, but does require the victim to visit a malicious page. Successful exploitation gives the attacker code execution within the Chrome sandbox, which combined with a sandbox escape could lead to full compromise of the browser process. A patched-image rebuild at 149.0.7827.53 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network; the victim's browser must be able to reach the attacker-controlled or compromised HTML page.

• AuthenticationNot required

  No account or credentials are needed on any system; the attacker only needs to get the victim to load a crafted page.

• Victim interactionRequired

  The victim must navigate to or be redirected to a crafted HTML page, making this a social-engineering or drive-by delivery scenario.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other unpredictable environmental factors.

Blast Radius

• The attacker gains arbitrary code execution within the Chrome renderer sandbox, enabling full control over JavaScript engine state and rendered content.
• Confidential data processed in the browser context, including session tokens, form inputs, and displayed page content, is readable by the attacker.
• The attacker can modify in-browser data, inject content into pages, and redirect user actions without the victim's awareness.
• Availability of the affected browser tab or process is disrupted; a renderer crash or forced termination is within the attacker's reach.