CVE-2026-10995: Chrome TabStrip Heap Buffer Overflow (CVSS 8.8)

Technical summary

CVE-2026-10995 is a CWE-122 heap buffer overflow affecting the TabStrip UI component in Chrome versions prior to 149.0.7827.53. The vulnerability arises from improper bounds checking during user interaction with tab-related UI elements. When a user performs specific gestures on a crafted HTML page, an attacker can write beyond allocated heap memory boundaries, potentially achieving arbitrary code execution in the context of the browser process. The network-accessible, low-complexity attack vector combined with a requirement for user interaction creates a realistic exploitation path.

Business impact

Compromise of Chrome could grant attackers access to browsing history, saved passwords, stored authentication tokens, and data within web applications. In enterprise environments, this could facilitate lateral movement, credential harvesting, or data exfiltration. The requirement for user interaction means social engineering or phishing campaigns could weaponize this vulnerability at scale. Organizations with users relying on Chrome for SaaS applications or sensitive web-based workflows face elevated risk.

Affected systems

Google Chrome prior to version 149.0.7827.53 is affected across all supported platforms (Windows, macOS, Linux). The vulnerability impacts Chrome users who have not applied the patching version or later. Chrome OS systems running vulnerable browser versions are also in scope.

Exploitability

The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates network accessibility with low attack complexity, but exploitation requires user interaction—specifically, convincing a target to perform defined gestures within the tab interface on a malicious page. This is not an unauthenticated, zero-interaction vulnerability. The attacker must craft a webpage that triggers the buffer overflow through specific UI actions, making this practical for targeted phishing or watering hole attacks but not suitable for mass compromise without social engineering.

Remediation

Update Google Chrome to version 149.0.7827.53 or later. For managed environments, administrators can use Chrome update policies to force deployment. Users should enable automatic updates if not already active. Organizations should prioritize patching Chrome on high-risk systems (those used for critical applications or sensitive access) within 2–4 weeks.

Patch guidance

Google Chrome version 149.0.7827.53 and later contain the fix for this vulnerability. Enterprise administrators can verify patch deployment through Chrome management console or by checking chrome://version in the address bar on target machines. Most users receive updates automatically, but manual updates can be triggered via Chrome menu > Settings > About Google Chrome. Verify patch application immediately after update, as Chrome must be fully restarted for the fix to take effect.

Detection guidance

Monitor for crashed Chrome processes, especially those with suspicious memory access patterns in debugging logs. Within browser telemetry, look for TabStrip-related exceptions or segmentation faults before patching. In endpoint detection and response (EDR) tools, flag abnormal Chrome child process behavior or unexpected code execution within the browser sandbox. Network-based detection is limited; focus on ensuring patches are deployed and monitoring user reports of Chrome crashes or unexpected behavior.

Why prioritize this

Although Chromium classified this as medium severity, the CVSS 8.8 score and direct path to heap corruption warrant prioritization. The combination of high confidentiality, integrity, and availability impact makes this a realistic vehicle for credential theft or malware installation. The requirement for user interaction reduces but does not eliminate risk, particularly in phishing-prone environments. Patch within 30 days, sooner for users handling sensitive data or authentication workflows.

Risk score, explained

The CVSS 8.8 (HIGH) reflects the confluence of network accessibility, low attack complexity, and catastrophic impact (confidentiality, integrity, and availability all compromised). The user interaction requirement prevents this from being a 9.0+, but does not substantially lower risk in social-engineering-aware threat landscapes. Organizations with mature security awareness programs and EDR coverage can reduce practical impact, but the vulnerability remains significant enough to mandate prompt patching.

Frequently asked questions