CVE-2026-10963: Integer overflow in V8 in Google Chrome prior to 149

Synopsis

An integer overflow in V8, the JavaScript engine embedded in Google Chrome, affects all versions prior to 149.0.7827.53. The flaw is reachable over the network and requires no authentication, but a victim must visit a crafted HTML page; once triggered, it allows a remote attacker to execute arbitrary code inside the Chrome sandbox. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network; the target Chrome instance must be reachable by directing the victim to an attacker-controlled or compromised URL.

• AuthenticationNot required

  No account or credential is needed; any unauthenticated remote party can serve the malicious page.

• Victim interactionRequired

  The victim must open or be redirected to a crafted HTML page, making this a social-engineering or drive-by-style attack.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental variables.

Blast Radius

• Executes arbitrary code inside the Chrome renderer sandbox, giving the attacker control of the sandboxed process.
• Reads sensitive in-browser data including session cookies, stored credentials, and page content from any open origin (Confidentiality: High).
• Writes or modifies in-browser state, potentially injecting malicious scripts or altering data the user submits (Integrity: High).
• Crashes or hangs the affected Chrome process or tab, disrupting the user's session (Availability: High).