CVE-2026-10987: Integer overflow in V8 in Google Chrome prior to 149

Synopsis

An integer overflow in the V8 JavaScript engine affects Google Chrome versions prior to 149.0.7827.53. The vulnerability is reachable over the network and requires no authentication, though a victim must visit a crafted HTML page for exploitation to succeed. Successful exploitation gives an attacker arbitrary code execution inside the Chrome sandbox, enabling data disclosure, content tampering, and potential service disruption. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the victim over the network, as the crafted HTML page is delivered remotely via a standard browser request.

• AuthenticationNot required

  No account or credentials on the target system are needed; any unauthenticated remote attacker can attempt exploitation.

• Victim interactionRequired

  A victim must be social-engineered into visiting a crafted HTML page, making user interaction a necessary step for exploitation.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and imposes no special conditions such as race timing or specific memory layout requirements.

Blast Radius

• A successful attacker executes arbitrary code within the Chrome sandbox, gaining control of the renderer process.
• Confidential data visible to the browser process, including page contents, stored credentials, and session tokens, can be read.
• The attacker can modify in-page content and inject malicious scripts, tampering with data the victim sees and submits.
• The compromised renderer process can be crashed or made unresponsive, disrupting browser availability for the victim.