CVE-2026-10960: Uninitialized Use in Codecs in Google Chrome prior to 149

Synopsis

An uninitialized memory use vulnerability in Google Chrome's codec handling allows a remote attacker who has already compromised the renderer process to escape Chrome's sandbox via a crafted HTML page. The attack requires no authentication but does need the victim to visit a malicious page, and it is reachable over the network with high attack complexity. Successful exploitation gives the attacker full read, write, and crash capability outside the sandbox, effectively turning a renderer compromise into a host-level foothold. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted HTML page over the network, so the target service or browser must be reachable from an external or remote origin.

• AuthenticationNot required

  No account or credential is needed; any unauthenticated user who visits the malicious page is a viable target.

• Victim interactionRequired

  The victim must navigate to or be redirected to a crafted HTML page, making social engineering or a malicious ad/link a prerequisite.

• Attack complexityDetail

  Attack complexity is High, meaning the attacker must first achieve renderer-process compromise before this sandbox-escape primitive becomes usable, introducing a multi-stage dependency.

Blast Radius

• The attacker reads arbitrary memory outside the Chrome sandbox, including stored credentials, session tokens, and data from other browser processes.
• The attacker writes to memory outside the sandbox, enabling code injection or persistent modification of host-level data.
• The attacker can crash the host-side Chrome process or dependent services, causing denial of service beyond the sandboxed renderer.
• Combined read-write access outside the sandbox effectively grants a host-level foothold, allowing further lateral movement within the container or underlying node.