CVE-2026-10989: Inappropriate implementation in V8 in Google Chrome prior to 149

Synopsis

Heap corruption via inappropriate implementation in Google Chrome's V8 JavaScript engine affects all Chrome versions before 149.0.7827.53. The vulnerability is reachable over the network and requires no authentication, but a victim must be convinced to perform specific UI gestures on a crafted HTML page. Successful exploitation gives an attacker full read, write, and execution capability within the affected browser process, enabling data theft, content manipulation, or remote code execution. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted HTML page over the network, so the victim's browser must be able to reach an attacker-controlled or compromised web origin.

• AuthenticationNot required

  No account or credentials are needed; any user who visits the malicious page is a valid target.

• Victim interactionRequired

  The attacker must convince the victim to perform specific UI gestures on the crafted page, requiring a degree of social engineering to complete the exploit.

• Attack complexityDetail

  Attack complexity is Low, meaning the exploit is reliable and does not depend on race conditions, memory layout randomization, or other variable environmental factors.

Blast Radius

• Reads in-process memory, including stored session cookies, saved credentials, and page content from other origins accessible to the browser process.
• Writes arbitrary data into heap memory, allowing the attacker to overwrite internal V8 structures and escalate toward controlled code execution.
• Executes attacker-supplied code within the Chrome renderer process, enabling further exploitation of the host if sandbox escapes are chained.
• Crashes or destabilizes the affected browser process if exploitation is only partially successful, causing denial of service for the user.