CVE-2026-10989: Chrome V8 Heap Corruption – Patch to 149.0.7827.53

Technical summary

CVE-2026-10989 is a heap corruption vulnerability in the V8 engine (Chrome's JavaScript runtime) stemming from improper implementation logic. The flaw is classified under CWE-122 (Heap-based Buffer Overflow). The attack vector is network-based with low attack complexity, meaning a remote attacker can deliver the malicious payload via a web page without special network positioning. However, the vulnerability requires user interaction—specifically, specific UI gestures—to trigger the exploit condition. The heap corruption could lead to arbitrary code execution in the context of the Chrome process, affecting confidentiality, integrity, and availability. Chromium has assigned this a High security severity rating.

Business impact

If exploited successfully, this vulnerability could allow attackers to steal credentials, browsing history, cached data, or files accessible to the user's Chrome profile. In enterprise environments where users browse the web as part of their work, this becomes a vector for data exfiltration or lateral movement. The requirement for user interaction—while a limiting factor—is not a strong barrier given social engineering and phishing campaigns. Organizations relying on Chrome for business operations face potential compromise of user sessions and sensitive information.

Affected systems

Google Chrome versions prior to 149.0.7827.53 are affected. This includes all stable, beta, and developer channel releases below that version. The vulnerability does not affect other Chromium-based browsers unless they have separately backported the vulnerable V8 code, though users of other Chromium derivatives should verify their vendor's advisory. Desktop and mobile Chrome installations are at risk.

Exploitability

The vulnerability has a CVSS score of 8.8 (HIGH), reflecting high exploitability potential. The attack complexity is low—an attacker need only host a malicious HTML page and convince a user to visit it. No authentication is required, and the network attack surface is broad. The limiting factor is the requirement for specific UI gestures; an attacker must carefully craft the page and social engineering to reliably trigger the necessary user actions. The vulnerability is not yet listed on CISA's Known Exploited Vulnerabilities (KEV) catalog, suggesting active exploitation in the wild has not been publicly confirmed at the time of publication.

Remediation

Update Google Chrome to version 149.0.7827.53 or later immediately. Chrome's auto-update mechanism typically deploys patches automatically, but users should verify their current version (Menu > About Google Chrome) to confirm the patch has been applied. For enterprise environments, administrators should enforce Chrome updates through their deployment tools or group policies to ensure rapid patching across the organization.

Patch guidance

Verify your Chrome version by navigating to Chrome Menu > About Google Chrome. If Chrome is not on version 149.0.7827.53 or later, the browser will automatically check for and download available updates. Restart Chrome to complete installation. Enterprise administrators should verify patch deployment to managed devices via their MDM or group policy console. There are no workarounds; patching is the only mitigation.

Detection guidance

Monitor for network traffic to suspicious or newly registered domains hosting exploit pages. Monitor Chrome crash dumps for patterns consistent with heap corruption (heap exceptions, buffer overflows). Endpoint Detection and Response (EDR) tools should flag unusual memory access patterns or privilege escalation attempts following Chrome process anomalies. Behavioral detections looking for Chrome spawning unexpected child processes or accessing sensitive file locations post-exploitation may catch post-compromise activity. Monitor user reports of crashes or unusual Chrome behavior.

Why prioritize this

This vulnerability merits immediate patching priority due to its HIGH CVSS score (8.8), the broad network attack surface, and the realistic attack chain (phishing to a malicious page + social engineering for UI interaction). Although not yet on CISA's KEV list, the combination of memory corruption and the ubiquity of Chrome in enterprise environments presents significant risk. The heap corruption primitive is a strong stepping stone to code execution, making this more dangerous than lower-severity UI or denial-of-service flaws.

Risk score, explained

The CVSS 3.1 score of 8.8 reflects: (1) Network-based attack vector with no authentication required (AV:N/PR:N), (2) Low attack complexity indicating straightforward exploit delivery (AC:L), (3) User interaction as a mitigating factor but not a strong one given social engineering (UI:R), and (4) High impact across confidentiality, integrity, and availability—the attacker can read memory, modify execution, or crash the process (C:H/I:H/A:H). The lack of scope change (S:U) indicates the impact is limited to the Chrome process context, though that context has broad access to the user's data.

Frequently asked questions