CVE-2026-10938: Inappropriate implementation in Input in Google Chrome prior to 149

Synopsis

An inappropriate implementation flaw in the Input handling component of Google Chrome prior to version 149.0.7827.53 allows a remote attacker who has already compromised the renderer process to bypass site isolation. The attack is reachable over the network and requires no authentication, though a victim must interact with a crafted HTML page. Successful exploitation grants the attacker unauthorized read access to sensitive cross-site data and the ability to tamper with cross-origin content. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted HTML page over the network, requiring the victim's browser to reach an attacker-controlled or compromised remote resource.

• AuthenticationNot required

  No account credentials or prior authentication are needed; the attack is reachable by any unauthenticated remote party.

• Victim interactionRequired

  The victim must visit or be directed to a crafted HTML page, making this a social-engineering or drive-by delivery scenario.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layout, or other variable environmental factors, though a prior renderer compromise is a prerequisite condition.

Blast Radius

• Reads cross-origin data from other sites loaded in the browser, such as session tokens, page content, or stored credentials, by bypassing site isolation boundaries.
• Modifies or injects content into cross-origin contexts, enabling tampering with data the victim exchanges with other sites.
• The attack is scoped to the browser process and does not directly affect system availability; no denial-of-service or crash impact is expected based on the CVSS vector.