CVE-2026-10971: Insufficient validation of untrusted input in Printing in Google Chrome on Windows prior to 149

Synopsis

This is an insufficient input validation vulnerability in the Printing component of Google Chrome on Windows, affecting versions prior to 149.0.7827.53. A remote attacker who has already compromised the Chrome renderer process can exploit this flaw over the network, without any credentials, by tricking a user into visiting a crafted HTML page. Successful exploitation enables a sandbox escape, giving the attacker the ability to read sensitive data, tamper with files, and disrupt services outside the normally restricted browser sandbox. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing the victim to a crafted HTML page hosted remotely.

• AuthenticationNot required

  No credentials or account access are needed; the attacker operates as an anonymous remote party.

• Victim interactionRequired

  The victim must visit a crafted HTML page, meaning the attacker must socially engineer the user into browsing to a malicious URL.

• Attack complexityDetail

  Exploitation is rated high complexity, meaning the attacker must have already compromised the Chrome renderer process as a prerequisite before this flaw can be leveraged.

Blast Radius

• Reads sensitive data accessible outside the Chrome sandbox, including stored credentials, session tokens, or files on the Windows host.
• Modifies files or system state on the Windows host that the sandboxed renderer would normally be prevented from touching.
• Crashes or destabilizes processes on the host outside the browser sandbox, causing service disruption.
• Gains full code execution outside the browser sandbox, enabling the attacker to pivot further into the host operating system.