CVE-2026-10965: Integer overflow in DevTools in Google Chrome prior to 149

Synopsis

An integer overflow vulnerability in the DevTools component of Google Chrome (versions prior to 149.0.7827.53) allows a remote attacker to execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. The vulnerability is reachable over the network and requires no authentication, only a single user interaction (visiting a malicious page). Successful exploitation grants the attacker code execution within the Chrome sandbox, enabling data theft, content tampering, and potential sandbox-escape chaining. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing the victim to a crafted HTML page, so the Chrome instance must be reachable in a browsing context exposed to external or attacker-controlled content.

• AuthenticationNot required

  No account or credentials are needed; any unauthenticated remote party can serve the malicious page.

• Victim interactionRequired

  The victim must visit or be redirected to a crafted HTML page, making a social-engineering or malicious-ad delivery vector necessary.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special environmental conditions, race-window timing, or memory-layout knowledge.

Blast Radius

• Executes arbitrary code inside the Chrome renderer sandbox, giving the attacker a foothold to read in-browser session tokens, saved passwords, and page content.
• Modifies in-page content and DOM state, enabling credential harvesting or silent form-data interception.
• Disrupts the affected browser session and can crash the renderer process, causing loss of unsaved user work.
• Serves as a starting point for sandbox-escape chaining if a second vulnerability is available, potentially reaching the underlying host OS.