CVE-2026-10942: Inappropriate implementation in UI in Google Chrome on Windows prior to 149

Synopsis

An inappropriate UI implementation in Google Chrome on Windows (versions before 149.0.7827.53) allows a local attacker to escalate privileges by convincing a user to open a malicious file. The attack requires no prior authentication but does require the victim to interact with a crafted file, and exploitation succeeds reliably without special environmental conditions. Successful exploitation gives the attacker full read, write, and execution control over the affected system. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network exposure is required.

• AuthenticationNot required

  No account or credential is needed before launching the attack; any unauthenticated local presence is sufficient.

• Victim interactionRequired

  The victim must open or interact with a malicious file, making this a social-engineering vector that requires the attacker to deliver the file to a local user.

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race conditions, memory layout dependencies, or other environmental factors need to align.

Blast Radius

• Reads sensitive files, stored credentials, browser session tokens, and other protected data on the host.
• Modifies or overwrites files and system configuration, enabling persistence or sabotage.
• Executes arbitrary code at an elevated privilege level, giving the attacker control over the affected Windows host.