CVE-2026-10970: Insufficient validation of untrusted input in InterestGroups in Google Chrome prior to 149

Synopsis

Insufficient input validation in Google Chrome's InterestGroups component allows a remote attacker who has already compromised the renderer process to escape the browser sandbox via a crafted HTML page. The vulnerability is reachable over the network but requires victim interaction (visiting a malicious page) and involves high attack complexity due to the prerequisite renderer compromise. Successful exploitation gives the attacker full read, write, and availability impact outside the sandbox, effectively achieving code execution at the host process level. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted HTML page over the network, requiring the victim's browser to reach an attacker-controlled or compromised web origin.

• AuthenticationNot required

  No authentication is needed; the attack can be launched from any publicly accessible web page without credentials.

• Victim interactionRequired

  The victim must visit or be redirected to the crafted HTML page, making social engineering or malicious ad delivery the likely delivery mechanism.

• Attack complexityDetail

  Attack complexity is high because the attacker must have already compromised the Chrome renderer process before this vulnerability can be used to escape the sandbox.

Blast Radius

• A successful sandbox escape lets the attacker execute arbitrary code in the host browser process, outside the renderer sandbox's restrictions.
• The attacker reads files, credentials, and session tokens accessible to the browser process on the host system.
• The attacker writes or modifies data on the host filesystem with the permissions of the browser process user.
• The attacker can crash or destabilize the browser process, causing a denial of service for the affected user session.