CVE-2026-10946: Heap buffer overflow in Media in Google Chrome prior to 149

Synopsis

A heap buffer overflow vulnerability exists in the Media component of Google Chrome versions prior to 149.0.7827.53. The flaw is reachable over the network but requires the attacker to trick a user into performing specific UI gestures on a crafted HTML page, and no authentication is needed on the attacker's side. Successful exploitation allows the attacker to execute arbitrary code inside the Chrome sandbox, combining full confidentiality, integrity, and availability impact within that sandbox context. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must deliver a crafted HTML page to the victim over the network, meaning the Chrome instance must be reachable by or directed to attacker-controlled web content.

• AuthenticationNot required

  No account or credential is required on the attacker's side; any unauthenticated remote party can serve the malicious page.

• Victim interactionRequired

  The attacker must convince the target user to perform specific UI gestures on the crafted page, making this a social-engineering-dependent attack.

• Attack complexityDetail

  Attack complexity is rated High, meaning the exploit depends on environmental or timing conditions beyond the attacker's direct control, such as specific media-processing state or memory layout inside Chrome.

Blast Radius

• Executes arbitrary code inside the Chrome renderer sandbox, giving the attacker control over the sandboxed process.
• Reads memory contents accessible within the sandbox, which may include cached page data, session tokens, or in-memory credentials.
• Modifies in-process state or on-disk resources writable by the sandboxed renderer, potentially corrupting browser storage or injecting content.
• Crashes or hangs the affected Chrome renderer process, disrupting the user's browsing session.