CVE-2026-10969: Insufficient validation of untrusted input in Extensions in Google Chrome prior to 149

Synopsis

Insufficient input validation in the Extensions component of Google Chrome (versions prior to 149.0.7827.53) allows a remote attacker who has already compromised the renderer process to escalate privileges through a crafted HTML page. The attack is reachable over the network but requires the victim to interact with a malicious page, and no authentication is needed. Successful exploitation gives the attacker elevated privileges within the browser, enabling full read, write, and disruption of affected resources. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted HTML page over the network, so the service must be reachable from a remote origin.

• AuthenticationNot required

  No account or credentials are needed; any unauthenticated user browsing to the malicious page can trigger the vulnerability.

• Victim interactionRequired

  The target must visit or be directed to a crafted HTML page, making social engineering or malicious-ad delivery a necessary part of the attack chain.

• Attack complexityDetail

  Exploitation is rated High complexity because it requires a prior renderer-process compromise as a precondition, introducing significant environmental constraints.

Blast Radius

• A successful attacker reads sensitive data accessible at elevated browser-privilege level, including stored credentials, session tokens, and page content from cross-origin contexts.
• The attacker modifies browser state or persisted data at an escalated privilege level, potentially altering extension behavior or injecting code into privileged browser contexts.
• The attacker can disrupt or crash browser components running at elevated privilege, causing loss of availability for the affected browser session or associated services.
• Because all three CVSS impact dimensions are rated High, the attacker gains broad control over the compromised browser process and any resources it can reach.