CVE-2026-10966: Inappropriate implementation in Codecs in Google Chrome prior to 149

Synopsis

An inappropriate implementation flaw in the Codecs component of Google Chrome prior to version 149.0.7827.53 allows a remote attacker to perform a sandbox escape by convincing a user to open a crafted video file. The vulnerability is reachable over the network and requires no authentication, though the victim must interact with malicious content. Successful exploitation gives the attacker full read, write, and availability impact on the affected system, breaking out of Chrome's sandboxed process isolation. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the malicious video file over the network, so the affected Chrome instance must be reachable or browsing to attacker-controlled content on the internet or an internal network.

• AuthenticationNot required

  No account or credential is needed; the attacker only needs to get the victim to load the crafted content.

• Victim interactionRequired

  The victim must open or navigate to a page containing the crafted video file, making this a social-engineering or drive-by delivery scenario.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special race conditions, memory-layout knowledge, or other environmental preconditions.

Blast Radius

• Attacker escapes Chrome's sandbox and gains code execution in the context of the browser process on the host OS.
• Confidentiality impact is high: the attacker can read files, credentials, and session data accessible to the browser process.
• Integrity impact is high: the attacker can write or modify files and data on the host system.
• Availability impact is high: the attacker can crash or terminate the browser process or other host services.