CVE-2026-10995: Heap buffer overflow in TabStrip in Google Chrome prior to 149

Synopsis

Heap buffer overflow in Google Chrome's TabStrip component (versions prior to 149.0.7827.53) allows a remote attacker to corrupt heap memory by tricking a user into performing specific UI interactions on a crafted HTML page. The vulnerability is reachable over the network and requires no authentication, though it does require the victim to engage with attacker-controlled content. Successful exploitation gives the attacker full read, write, and crash capabilities over the affected browser process. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted HTML page over the network, so the victim's browser must be able to reach attacker-controlled web content.

• AuthenticationNot required

  No account or credential is needed; the attacker only needs to serve a page the victim visits.

• Victim interactionRequired

  The attacker must convince the victim to perform specific UI gestures (such as tab interactions) on the crafted page, making social engineering a prerequisite.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, special memory layouts, or other unpredictable environmental factors.

Blast Radius

• Reads arbitrary memory from the Chrome browser process, exposing stored session tokens, saved passwords, and in-memory page content.
• Writes to heap memory, allowing the attacker to corrupt internal browser state or inject attacker-controlled data into the process.
• Crashes the affected Chrome process, causing loss of the current browsing session and any unsaved in-tab state.
• Heap corruption at this severity level is commonly leveraged as a stepping stone toward full renderer or browser process code execution.