CVE-2026-10917: Chrome Media Sandbox Escape Vulnerability (High CVSS 8.3)

Technical summary

The vulnerability stems from insufficient input validation in Chrome's media processing code (CWE-20). An attacker positioned with renderer process compromise can supply crafted HTML containing malformed media data that bypasses sandbox restrictions. The sandbox escape converts a limited renderer-level compromise into potential full system compromise, affecting Chrome on Windows, macOS, and Linux. The attack chain requires initial renderer exploitation, but the subsequent sandbox escape significantly amplifies impact.

Business impact

For organizations, this vulnerability represents a two-stage attack risk. First, users must be compromised at the renderer level (via malware, phishing, or prior vulnerabilities). Second, those compromises become critical if users visit attacker-controlled sites. Desktop environments relying on Chrome for work carry elevated exposure. Unpatched instances could enable lateral movement, credential theft, or malware persistence at the OS level, transforming what might be a contained browser compromise into enterprise-wide incident severity.

Affected systems

Google Chrome prior to version 149.0.7827.53 on all major platforms: Windows, macOS, and Linux systems. The vulnerability also may affect Chromium-based browsers derived from affected versions. Apple macOS, Linux kernel, and Microsoft Windows systems running vulnerable Chrome versions are the affected deployment contexts.

Exploitability

Exploitation requires two prerequisites: (1) the renderer process must already be compromised through a separate vulnerability or attack, and (2) user interaction to visit a crafted webpage. The CVSS vector reflects High complexity due to these preconditions, but in targeted attack scenarios where both conditions exist, exploitability is practical. The vulnerability is not in the CISA KEV catalog, indicating no evidence of in-the-wild exploitation at the time of initial assessment.

Remediation

Update Google Chrome to version 149.0.7827.53 or later. Chrome's auto-update mechanism will deploy patches automatically for most users within days of release. Organizations managing Chrome through group policy or mobile device management should verify deployment status across their installed base. Users who manually manage updates should initiate updates immediately.

Patch guidance

Deploy Chrome version 149.0.7827.53 or later across all endpoints. For managed environments, verify the update via About Chrome (chrome://settings/help) or consult your MDM/SCCM deployment logs. Chromium projects and derivative browsers should apply equivalent patches from their upstream. Test patches in non-production environments first if your organization runs critical workflows in Chrome.

Detection guidance

Monitor Chrome version inventory to identify instances below 149.0.7827.53. Endpoint detection and response (EDR) systems should alert on renderer process crashes followed by suspicious system calls, as sandbox escapes often leave detectable patterns in process behavior. Browser extension monitoring and suspicious HTML/media file ingestion from untrusted sources may provide early warning. Log Chrome crash reports and correlate with user web activity.

Why prioritize this

While the vulnerability requires pre-existing renderer compromise, sandbox escapes are critical because they amplify the impact of every other browser vulnerability. Organizations with high-value users (executives, developers, security teams) or those in targeted sectors should prioritize patching quickly. The High CVSS score, broad platform coverage, and risk-amplifying nature justify treating this as a near-term remediation target.

Risk score, explained

The CVSS 8.3/High score reflects high confidentiality, integrity, and availability impact (C:H, I:H, A:H) balanced against attack complexity (AC:H) due to the required renderer compromise and user interaction prerequisites. The network-accessible attack vector and scope change (S:C) indicate system-wide compromise potential. The score appropriately captures that while exploitation barriers exist, successful attacks are severe.

Frequently asked questions