CVE-2026-10940: Race in Codecs in Google Chrome on Windows prior to 149

Synopsis

A race condition in the Codecs component of Google Chrome on Windows allows a remote attacker who has already compromised the browser's renderer process to escape the sandbox via a crafted HTML page. The attack requires network access and a victim to interact with attacker-controlled content, but no authentication is needed. Successful exploitation gives the attacker full code execution outside the Chrome sandbox, breaking the primary security boundary that contains a compromised renderer. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the victim over the network, typically by serving a crafted HTML page from a remote host.

• AuthenticationNot required

  No account or credential is needed; the attack path requires only that the victim loads attacker-controlled content.

• Victim interactionRequired

  The victim must visit or be redirected to a crafted HTML page, requiring a social-engineering or drive-by delivery step.

• Attack complexityDetail

  Exploitation is rated AC:H, meaning the attacker must win a race condition in the Codecs component, which depends on precise timing and may require repeated attempts or environmental factors to succeed reliably.

Blast Radius

• An attacker who wins the race condition escapes the Chrome sandbox on Windows, gaining arbitrary code execution in the context of the browser process outside the sandbox boundary.
• With sandbox escape achieved, the attacker can read files and credentials accessible to the browser process user account, including stored cookies, saved passwords, and local session tokens.
• The attacker can write or modify files on the host filesystem within the permissions of the running user, enabling persistence mechanisms such as dropping executables or modifying startup entries.
• The attacker can crash or disrupt Chrome and any dependent processes, causing denial of service for the affected user session.