Stack buffer overflow in GPU in Google Chrome prior to 149

CVE-2026-10898 is a stack buffer overflow in Chrome's GPU component affecting versions before 149.0.7827.53. Per the official CVE record, exploitation requires an attacker to have already compromised the renderer process, then use a crafted HTML page to try to turn that foothold into a sandbox escape. In plain English: this is not the bug that gets the attacker into the browser; it is the bug that may let them climb out of the browser sandbox after they are already in.

The vendor-side severity story is inflated for fleet triage if you read it like an initial-access bug. Yes, the technical impact is ugly if chained successfully, but the gating condition is everything: renderer compromise is a prior stage, which means this CVE is mostly valuable to attackers who already have a separate browser bug or equivalent foothold. With no KEV listing, no public exploitation evidence, and a tiny EPSS, this lands as a downshift from vendor HIGH to operational MEDIUM for enterprise patch scheduling.

Why this verdict

• Downward adjustment: requires prior renderer compromise — that means the attacker is already partway through a browser exploit chain before this CVE matters.
• Downward adjustment: client-side + UI required — exploitation still depends on victim interaction with crafted content, not a wormable exposed service.
• Downward adjustment: AC:H and no live abuse signal — high complexity plus no KEV and no public weaponization keeps this out of top-tier patch panic.
• Upward adjustment: Chrome is everywhere — even second-stage browser escapes matter because endpoint population is huge and successful impact is full sandbox break.

Why not higher?

This is not a clean unauthenticated remote initial-access bug. The advisory itself says the attacker must have already compromised the renderer process, which is a major chain dependency and a strong real-world severity brake. Add no KEV, no public exploit, and a very low EPSS, and there is no evidence-based case for HIGH or CRITICAL fleet urgency.

Why not lower?

A browser sandbox escape is still strategically important because it can turn a renderer foothold into meaningful host compromise. Chrome is ubiquitous in enterprise fleets, and if this bug gets paired with a renderer exploit later, the impact is serious enough that you should not bury it as backlog trivia.

1. Force auto-update compliance — Use your browser management stack to verify Chrome channels are updating and pin stragglers for correction. For a MEDIUM verdict there is no mitigation SLA, but this is still the fastest risk reducer before the noisgate remediation SLA of ≤ 365 days.
2. Shrink risky browsing surfaces — Apply stricter policy to unmanaged extensions, high-risk web categories, and unnecessary GPU-accelerated browser use cases on sensitive admin endpoints. This reduces the chance of the first-stage renderer compromise that this CVE depends on; with MEDIUM there is no mitigation SLA, so use this where operationally cheap while patching inside the 365-day window.
3. Harden privileged workstations — Prioritize fast browser updates on administrator, developer, and help-desk endpoints where a sandbox escape has outsized blast radius. Even without a mitigation SLA, these systems deserve earlier attention because the post-escape payoff is higher.
4. Watch for browser exploit precursors — Tune EDR and crash telemetry for repeated Chrome renderer/GPU crashes, suspicious browser child-process behavior, and anomalous post-browser execution. That will catch the chain around this CVE better than network scanners will, and can be deployed during the remediation window.

Run this on the target endpoint or through your EDR/remote shell on representative hosts. Invoke it as python3 check_chrome_cve_2026_10898.py on macOS/Linux or py check_chrome_cve_2026_10898.py on Windows; no admin rights are required unless your environment blocks access to program files.

#!/usr/bin/env python3
# check_chrome_cve_2026_10898.py
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN

import os
import platform
import re
import subprocess
import sys
from pathlib import Path

THRESHOLD = (149, 0, 7827, 53)


def parse_version(text):
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text or '')
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def cmp_version(a, b):
    return (a > b) - (a < b)


def run_version_command(cmd):
    try:
        p = subprocess.run(cmd, capture_output=True, text=True, timeout=5)
        out = (p.stdout or '') + ' ' + (p.stderr or '')
        return parse_version(out.strip())
    except Exception:
        return None


def candidate_commands():
    cmds = []
    system = platform.system().lower()

    if system == 'windows':
        local = os.environ.get('LOCALAPPDATA', '')
        prog = os.environ.get('PROGRAMFILES', '')
        progx86 = os.environ.get('PROGRAMFILES(X86)', '')
        candidates = [
            Path(local) / 'Google/Chrome/Application/chrome.exe',
            Path(prog) / 'Google/Chrome/Application/chrome.exe',
            Path(progx86) / 'Google/Chrome/Application/chrome.exe',
            Path(local) / 'Chromium/Application/chrome.exe',
            Path(prog) / 'Chromium/Application/chrome.exe',
            Path(progx86) / 'Chromium/Application/chrome.exe',
        ]
        for c in candidates:
            if str(c).strip() and c.exists():
                cmds.append([str(c), '--version'])
        cmds.extend([
            ['reg', 'query', r'HKCU\Software\Google\Chrome\BLBeacon', '/v', 'version'],
            ['reg', 'query', r'HKLM\Software\Google\Chrome\BLBeacon', '/v', 'version'],
            ['reg', 'query', r'HKLM\Software\WOW6432Node\Google\Chrome\BLBeacon', '/v', 'version'],
        ])
    elif system == 'darwin':
        candidates = [
            '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
            str(Path.home() / 'Applications/Google Chrome.app/Contents/MacOS/Google Chrome'),
            '/Applications/Chromium.app/Contents/MacOS/Chromium',
        ]
        for c in candidates:
            if os.path.exists(c):
                cmds.append([c, '--version'])
        cmds.extend([
            ['google-chrome', '--version'],
            ['chromium', '--version'],
            ['chromium-browser', '--version'],
        ])
    else:
        cmds.extend([
            ['google-chrome', '--version'],
            ['google-chrome-stable', '--version'],
            ['chromium', '--version'],
            ['chromium-browser', '--version'],
            ['/opt/google/chrome/chrome', '--version'],
            ['/usr/bin/google-chrome', '--version'],
            ['/usr/bin/chromium', '--version'],
            ['/usr/bin/chromium-browser', '--version'],
        ])

    return cmds


def main():
    found = []
    for cmd in candidate_commands():
        ver = run_version_command(cmd)
        if ver:
            found.append((cmd[0], ver))

    if not found:
        print('UNKNOWN - Chrome/Chromium not found or version unreadable')
        sys.exit(2)

    # Use the highest detected version if multiple installs exist.
    path, ver = sorted(found, key=lambda x: x[1], reverse=True)[0]
    ver_str = '.'.join(str(x) for x in ver)
    threshold_str = '.'.join(str(x) for x in THRESHOLD)

    if cmp_version(ver, THRESHOLD) < 0:
        print(f'VULNERABLE - detected {ver_str} at {path}; requires >= {threshold_str}')
        sys.exit(1)
    else:
        print(f'PATCHED - detected {ver_str} at {path}; threshold is {threshold_str}')
        sys.exit(0)


if __name__ == '__main__':
    main()

Sources

1. Official CVE JSON record for CVE-2026-10898
2. Google Chrome stable channel update for Desktop (June 2, 2026)
3. Chromium issue 513946753
4. Chromium security page
5. CISA Known Exploited Vulnerabilities Catalog
6. FIRST EPSS model documentation
7. Chrome early stable update for Desktop 149.0.7827.53/.54