CVE-2026-10937: Inappropriate implementation in Passwords in Google Chrome prior to 149

Synopsis

An inappropriate implementation flaw in the Passwords component of Google Chrome (versions prior to 149.0.7827.53) allows a remote attacker to bypass the same-origin policy by tricking a user into visiting a crafted HTML page. The attack is reachable over the network and requires no authentication, only that the target user loads the malicious page. Successful exploitation gives the attacker unauthorized read access to credential data and the ability to tamper with password-related operations across origins. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must deliver the crafted HTML page to the victim over the network, requiring the target to be reachable through a browser session.

• AuthenticationNot required

  No account or login is needed; the attacker only needs to get the victim to load a page they control.

• Victim interactionRequired

  The victim must visit the attacker's crafted HTML page, making this a social-engineering vector requiring at least one deliberate or induced user action.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental factors.

Blast Radius

• Reads stored password data and credential material managed by Chrome's Passwords component across origins that the same-origin policy would normally protect.
• Modifies or injects password-related data by bypassing the origin boundary, enabling credential tampering or silent overwrite of saved passwords.
• Enables cross-origin data theft from web applications open in other tabs or frames if those contexts interact with Chrome's password manager.