CVE-2026-10962: Type Confusion in Media in Google Chrome prior to 149

Synopsis

A type confusion vulnerability in the Media component of Google Chrome prior to version 149.0.7827.53 allows a remote attacker to execute arbitrary code inside the browser sandbox by convincing a user to visit a crafted HTML page. The vulnerability is reachable over the network and requires no authentication, only a single user interaction such as clicking a malicious link or visiting an attacker-controlled page. Successful exploitation gives the attacker code execution within the Chrome sandbox, which combined with a sandbox escape could lead to full system compromise. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network; the target Chrome instance must be reachable in the sense that the user browses to an attacker-controlled or compromised URL.

• AuthenticationNot required

  No credentials or account access are needed; any unauthenticated remote attacker can serve the malicious HTML page.

• Victim interactionRequired

  The user must visit a crafted HTML page, meaning the attacker must direct or trick the target into opening the malicious URL.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and imposes no special race conditions or environmental prerequisites on the attacker.

Blast Radius

• Arbitrary code executes inside the Chrome renderer sandbox, giving the attacker control over the sandboxed process.
• The attacker reads all data accessible within the compromised renderer, including page content, session cookies, and stored credentials exposed to the process.
• The attacker can modify in-memory page state and inject content, potentially altering what the user sees or submitting requests on their behalf.
• A successful sandbox escape chained onto this vulnerability would extend access to the underlying host operating system and its files.