CVE-2026-10949: Heap buffer overflow in Video in Google Chrome prior to 149

Synopsis

A heap buffer overflow vulnerability exists in the Video component of Google Chrome prior to version 149.0.7827.53. The flaw is reachable over the network but requires a victim to interact with a crafted HTML page, and the attacker must have already compromised the renderer process; the CVSS score reflects a high-complexity attack chain. Successful exploitation enables a sandbox escape, giving the attacker read and write access to memory outside the sandboxed renderer with high impact to confidentiality, integrity, and availability. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted HTML page over the network, so the target Chrome instance must be reachable by or browsing content served from a remote origin.

• AuthenticationNot required

  No account or credential is needed to serve the malicious page to a victim; the attack requires no prior authentication to the target.

• Victim interactionRequired

  The victim must visit or be redirected to the attacker-controlled HTML page, making this a social-engineering or drive-by delivery scenario.

• Attack complexityDetail

  Attack complexity is high: the attacker must have already compromised the renderer process before the overflow can be used for a sandbox escape, introducing a significant prerequisite beyond the initial page load.

Blast Radius

• A successful sandbox escape lets the attacker execute code outside the Chrome sandbox with the privileges of the browser process, breaking the primary isolation boundary that Chrome relies on.
• The attacker gains high-confidentiality impact, meaning they can read memory, credentials, cookies, and session data held by the browser process outside the sandboxed renderer.
• High-integrity impact means the attacker can write to or corrupt data structures and files accessible to the browser process, including persisted profile data and locally stored credentials.
• High-availability impact means the attacker can crash or destabilize the browser process, causing a denial of service for the affected user session.