CVE-2026-10986: Integer overflow in Media in Google Chrome prior to 149

Synopsis

An integer overflow vulnerability in the Media component of Google Chrome (versions prior to 149.0.7827.53) allows a remote attacker to execute arbitrary code inside the Chrome sandbox by tricking a user into opening a malicious file. The attack is reachable over the network, requires no authentication, but does require the victim to interact with a crafted file. Successful exploitation gives an attacker code execution within the browser sandbox, which may serve as a stepping stone to further compromise. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the malicious file over the network, so the targeted service or user must be reachable from an internet or network-adjacent position.

• AuthenticationNot required

  No account or credential is needed; the attacker can target any Chrome user without prior authentication.

• Victim interactionRequired

  The victim must open or process a malicious file, requiring a social-engineering step such as a phishing link or a drive-by download.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other variable environmental factors.

Blast Radius

• Executes arbitrary code inside the Chrome renderer sandbox, giving the attacker a foothold in the browser process.
• Reads in-browser data including session tokens, saved credentials, and page content accessed during the session.
• Modifies or corrupts browser state and locally accessible data reachable from within the sandbox.
• Crashes or destabilizes the affected browser process, disrupting service for the victim user.