CVE-2026-10964: Integer overflow in V8 in Google Chrome prior to 149

Synopsis

An integer overflow in V8, the JavaScript engine embedded in Google Chrome, allows a remote attacker to execute arbitrary code inside the Chrome sandbox by convincing a user to visit a crafted HTML page. The vulnerability is reachable over the network and requires no authentication, though it does require the victim to open a malicious page. Successful exploitation gives the attacker code execution within the browser's sandbox, which can be a stepping stone to deeper system compromise. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the victim's browser over the network by serving a crafted HTML page from a remote origin.

• AuthenticationNot required

  No account or credential is needed; the exploit is triggered by any unauthenticated user visiting the malicious page.

• Victim interactionRequired

  The victim must navigate to or be redirected to the attacker-controlled HTML page, requiring a social-engineering step such as a phishing link.

• Attack complexityDetail

  Exploitation is reliable and condition-free once the victim loads the page; no race conditions or specific memory layout prerequisites are involved.

Blast Radius

• The attacker executes arbitrary code within the Chrome renderer sandbox, gaining the ability to run attacker-supplied JavaScript or native instructions in that context.
• Confidential data accessible to the browser process, including stored session tokens, page content, and in-memory form data, is readable by the attacker.
• The attacker can modify in-browser state, tamper with rendered page content, and issue requests to web services authenticated by the victim's active sessions.
• The renderer process can be crashed or destabilized, disrupting the victim's browsing session and any active web application workflows.