CVE-2026-10965: Chrome DevTools Integer Overflow Remote Code Execution

Technical summary

CVE-2026-10965 is an integer overflow vulnerability (CWE-472) residing in the DevTools component of Chromium. The vulnerability permits remote arbitrary code execution within the renderer sandbox via a crafted HTML page. The attack vector is network-based with low complexity; user interaction (visiting a malicious page) is required. The integrity of the sandboxing mechanism is not circumvented, but code execution within the confined environment still represents a significant security gap. Google rated this Chromium security severity as High.

Business impact

Successful exploitation could allow attackers to steal sensitive data processed within the browser, inject malicious content, or use compromised browser processes as a foothold for lateral movement within a network. Organizations relying on Chrome for accessing web-based applications or sensitive services face elevated risk of credential theft and data exfiltration. The need for user interaction reduces but does not eliminate the threat—social engineering or malicious advertisement networks can reliably deliver the exploit payload.

Affected systems

Google Chrome versions prior to 149.0.7827.53 are directly affected. The vulnerability impacts Chrome deployments across Windows, macOS, and Linux environments. Users on any of these operating systems running vulnerable Chrome versions require immediate patching.

Exploitability

Exploitation requires only network access and user interaction—a user must visit a crafted webpage. No authentication, special browser configuration, or local access is necessary. The low attack complexity and absence of preconditions make this vulnerability relatively straightforward to exploit. However, the requirement for user interaction (clicking a link, visiting a site) provides a limited window for defense through user awareness and network-level controls.

Remediation

Update Google Chrome to version 149.0.7827.53 or later. The patch is available through Chrome's automatic update mechanism; users should verify their version in Chrome Settings > About Chrome and confirm the update has applied. Organizations managing Chrome deployments should verify patch installation across their fleet before considering this vulnerability remediated.

Patch guidance

Chrome typically auto-updates; however, verify the update has completed by navigating to chrome://settings/help and confirming version 149.0.7827.53 or higher is installed. For enterprise deployments, verify Chrome update policies are enforced and that managed devices have received the patch. Some organizations may need to manually trigger updates or use mobile device management (MDM) tools to ensure coverage. After patching, restart the browser to ensure the new version is active.

Detection guidance

Monitor Chrome version inventory across your organization to identify instances running versions prior to 149.0.7827.53. Endpoint detection and response (EDR) tools should monitor for unusual DevTools subprocess creation or unexpected code execution within chrome.exe/chromium processes. Network-based detection is challenging since the exploit is delivered via standard HTTPS traffic; focus detection efforts on post-exploitation indicators such as credential access, process injection attempts, or data exfiltration. User reports of unexpected browser behavior or crashes in DevTools may indicate exploitation attempts.

Why prioritize this

Despite not being tracked in the Known Exploited Vulnerabilities (KEV) catalog, the combination of high CVSS score (8.8), remote exploitability, low attack complexity, and ubiquitous Chrome deployment warrants immediate prioritization. The requirement for user interaction is the primary limiting factor; however, attackers routinely achieve this through social engineering. Organizations should treat this as a critical patch priority given Chrome's central role in web access and data handling.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) reflects: network-based attack vector requiring only user interaction, low attack complexity, and high impact to confidentiality, integrity, and availability within the sandbox context. The score does not account for potential sandbox escape vectors or the prevalence of Chrome in enterprise environments, both of which could elevate real-world risk. The absence of KEV status indicates active exploitation has not yet been reported to CISA, but this does not imply the vulnerability is less serious—it may simply reflect early discovery or limited attacker visibility.

Frequently asked questions