Insufficient validation of untrusted input in Media in Google Chrome prior to 149

Based on the intel provided, this Chrome Media bug affects versions prior to 149.0.7827.53 and stems from insufficient validation of untrusted input. The important part is the hidden prerequisite in the description: the attacker must have already compromised the renderer process before this bug becomes usable, so this is not your entry bug.

Google's HIGH 8.3 framing overrates the operational risk for enterprises. In the real world, a bug that starts after renderer compromise and only yields code execution inside the sandboxed browser process is a narrow post-exploitation primitive, not a broad remote compromise event.

Why this verdict

• Major downgrade for prior compromise requirement: the description says the attacker must have already compromised the renderer process. That is a full exploit stage earlier, so this CVE is post-initial-access within the browser, not a fresh remote foothold.
• Another downgrade for contained impact: the stated outcome is arbitrary code execution *inside the sandbox*. Chrome's renderer sandbox and site-isolation model are specifically meant to limit that blast radius.
• Further downgrade for real-world signals: no KEV listing, no verified public exploitation evidence, no public PoC located, and a very low EPSS all point away from urgent attacker demand.

Why not higher?

There is no reviewed evidence here of sandbox escape, browser-process takeover, or host-level compromise from this CVE alone. If the bug had enabled a reliable escape from the renderer sandbox or was showing active exploitation, the score would climb fast.

Why not lower?

Chrome is ubiquitous in enterprise fleets, so even niche post-compromise browser primitives deserve inventory awareness and normal patch compliance. Also, renderer-native execution can still be useful as one link in a larger exploit chain, so this is not pure noise.

1. Enforce Chrome auto-update — Keep Chrome on the managed evergreen channel and verify version convergence through your endpoint tooling. For a LOW verdict there is no emergency deadline; handle it in normal browser hygiene rather than an out-of-band change window.
2. Harden extension policy — Reduce the easiest precondition by restricting extension install sources, requiring allowlists, and removing unused high-risk extensions. This matters because the biggest real-world barrier is the attacker still needing that first-stage renderer compromise; for LOW severity, roll this into standard policy maintenance.
3. Watch for browser breakout behavior — Tune EDR for suspicious browser child processes, token abuse, unusual command-line launches, and memory-protection alerts. The vulnerability itself is hard to signature, but the follow-on escape activity is where defenders usually get visibility; maintain these detections as standing controls.
4. Prioritize exploit-chain telemetry over CVSS headlines — Route this issue into the bucket for browser exploit-chain monitoring instead of treating it like an externally reachable server RCE. For LOW severity, use routine triage cadence and document that the key risk reducer is the required attacker position.

Run this on the Windows target host or push it through your RMM/EDR live response on endpoints with Chrome installed. Invoke with powershell -ExecutionPolicy Bypass -File .\check-chrome-cve-2026-10917.ps1; no admin rights are required because it only reads file version metadata.

# check-chrome-cve-2026-10917.ps1

# Purpose: Check whether Google Chrome is at or above the fixed version threshold

# Output: VULNERABLE / PATCHED / UNKNOWN

# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN


$ErrorActionPreference = 'Stop'
$fixedVersion = [version]'149.0.7827.53'

function Get-ChromePath {
    $candidates = @(
        "$env:ProgramFiles\Google\Chrome\Application\chrome.exe",
        "$env:ProgramFiles(x86)\Google\Chrome\Application\chrome.exe",
        "$env:LocalAppData\Google\Chrome\Application\chrome.exe"
    )

    foreach ($path in $candidates) {
        if (Test-Path $path) { return $path }
    }

    return $null
}

try {
    $chromePath = Get-ChromePath

    if (-not $chromePath) {
        Write-Output 'UNKNOWN - chrome.exe not found in standard install paths'
        exit 2
    }

    $file = Get-Item $chromePath
    $versionText = $file.VersionInfo.ProductVersion

    if (-not $versionText) {
        Write-Output "UNKNOWN - could not read ProductVersion from $chromePath"
        exit 2
    }

    # Normalize versions like 149.0.7827.53 (Official Build) etc.

    if ($versionText -match '(\d+\.\d+\.\d+\.\d+)') {
        $normalized = $matches[1]
    } else {
        Write-Output "UNKNOWN - unrecognized version format: $versionText"
        exit 2
    }

    $installedVersion = [version]$normalized

    if ($installedVersion -ge $fixedVersion) {
        Write-Output "PATCHED - Google Chrome version $installedVersion meets or exceeds fixed threshold $fixedVersion"
        exit 0
    } else {
        Write-Output "VULNERABLE - Google Chrome version $installedVersion is below fixed threshold $fixedVersion"
        exit 1
    }
}
catch {
    Write-Output "UNKNOWN - $($_.Exception.Message)"
    exit 2
}

Sources

1. Chrome Releases - Early Stable Update for Desktop
2. Chromium - Multi-process Architecture
3. Chromium Security - Chrome Sandbox Diagnostics for Windows
4. Chromium - Site Isolation Design Document
5. CISA - Known Exploited Vulnerabilities Catalog
6. FIRST - The EPSS Model
7. FIRST - EPSS Data and Statistics
8. StatCounter - Desktop Browser Market Share Worldwide