Script injection in Headless in Google Chrome prior to 149

CVE-2026-10928 is a script injection flaw in Chrome Headless that affects versions before 149.0.7827.53 on Linux and before 149.0.7827.53/.54 on Windows and macOS. The attacker supplies crafted HTML, and the vulnerable code path is only reached when that content is rendered by Headless Chrome—the unattended browser mode used by automation stacks, PDF/screenshot services, CI jobs, crawlers, preview generators, and tools such as Puppeteer.

Google's HIGH 8.8 rating is technically defensible for the bug in isolation, but it overstates the population actually reachable in most enterprises. The real-world friction is the big one: the target must be running headless rendering of attacker-controlled content. That sharply narrows exposure versus normal Chrome desktop browsing, and the very low EPSS plus no KEV listing and no reviewed exploitation evidence push this down into a controlled, environment-dependent risk rather than an all-hands emergency.

Why this verdict

• Starts at vendor HIGH 8.8 because unauthenticated remote content can trigger code execution with severe CIA impact.
• Downward adjustment: requires Headless mode. That implies a narrower target set than normal user browsing; many enterprises have thousands of Chrome installs but only dozens of headless render nodes.
• Downward adjustment: requires attacker-controlled render input. If your jobs only render trusted templates or internal pages, the attack chain never starts.
• Downward adjustment: commonly post-app-friction, not raw internet reach. The attacker usually needs a preview/export/crawl feature, CI workflow, or embedded automation service that accepts untrusted content.
• Further downward adjustment: no KEV, no reviewed exploitation evidence, very low EPSS. That weakens the case for emergency prioritization absent local exposure amplifiers.
• Still not LOW because exposed render farms can be quietly valuable**: service tokens, internal reachability, CI artifacts, screenshots/PDFs, and cloud metadata can all turn a 'niche' browser bug into an infrastructure incident.

Why not higher?

This is not a broad, no-click, fleet-wide desktop event. The chain narrows hard on two prerequisites: Headless Chrome must be in use, and it must be fed attacker-controlled HTML or URLs. Without evidence of active exploitation or a public PoC, calling this HIGH for most enterprises would overweight theoretical impact and underweight deployment reality.

Why not lower?

A lot of modern infrastructure quietly depends on Headless Chrome for rendering and automation, and those workers often sit near secrets, CI tokens, internal apps, or cloud APIs. If you do run internet-facing preview/PDF/screenshot features, the attacker position is effectively unauthenticated remote, which is too strong to dismiss as backlog-only hygiene.

1. Inventory headless usage — Identify every workload that launches Chrome with --headless or through Puppeteer/ChromeDriver and map which ones accept untrusted URLs or HTML. For a MEDIUM verdict there is no noisgate mitigation SLA — go straight to the 365-day remediation window, but do this discovery work now so the patch does not get lost behind desktop-only assumptions.
2. Fence untrusted render paths — Restrict preview, screenshot, and PDF generation features to allowlisted domains or sanitized templates where possible. This is the best risk reducer because it removes the attacker-controlled content prerequisite entirely; deploy as part of the same remediation cycle even though there is no formal mitigation SLA for MEDIUM.
3. Constrain renderer identities — Run headless workers with low-privilege service accounts, minimal filesystem access, no developer tokens, and tightly scoped cloud IAM. That keeps successful browser-process execution from turning into infrastructure compromise; complete during the 365-day remediation window if not already in place.
4. Segment and egress-filter render nodes — Limit outbound network access from screenshot/PDF/CI renderer subnets to only the domains and APIs they genuinely need. This cuts off follow-on recon and exfiltration if exploitation occurs, and it is especially important for internet-facing render services.
5. Update bundled browser runtimes — Patch not just visible desktop Chrome but also container images, CI images, and app-bundled Chrome-for-Testing or Chromium copies. Headless stacks frequently pin old browser versions; for MEDIUM, clear those through the noisgate remediation SLA of ≤365 days.

Run this on the target host or container image that may execute Chrome Headless. Invoke it with python3 check_cve_2026_10928.py or python3 check_cve_2026_10928.py --version "Google Chrome 149.0.7827.52"; no admin rights are required, but local read/execute access to Chrome binaries helps automatic discovery.

#!/usr/bin/env python3
# check_cve_2026_10928.py
# Determine likely exposure to CVE-2026-10928 by checking installed Chrome/Chromium version.
# Outputs exactly one of: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import shutil
import subprocess
import sys

PATCH_WIN_MAC = (149, 0, 7827, 54)   # conservative threshold for Windows/macOS
PATCH_LINUX   = (149, 0, 7827, 53)

COMMON_COMMANDS = [
    "google-chrome",
    "google-chrome-stable",
    "chromium",
    "chromium-browser",
    "chrome",
    "msedge",
]

COMMON_PATHS = [
    "/usr/bin/google-chrome",
    "/usr/bin/google-chrome-stable",
    "/usr/bin/chromium",
    "/usr/bin/chromium-browser",
    "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome",
    r"C:\Program Files\Google\Chrome\Application\chrome.exe",
    r"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe",
]


def parse_version(text):
    m = re.search(r"(\d+)\.(\d+)\.(\d+)\.(\d+)", text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def version_to_str(v):
    return ".".join(str(x) for x in v) if v else "unknown"


def cmp_version(a, b):
    return (a > b) - (a < b)


def run_cmd(cmd):
    try:
        p = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, timeout=8)
        out = (p.stdout or "") + "\n" + (p.stderr or "")
        return out.strip()
    except Exception:
        return ""


def find_version_from_commands():
    checked = []
    for c in COMMON_COMMANDS:
        path = shutil.which(c)
        if not path:
            continue
        checked.append(path)
        out = run_cmd([path, "--version"])
        v = parse_version(out)
        if v:
            return v, path, checked
    return None, None, checked


def find_version_from_paths():
    checked = []
    for p in COMMON_PATHS:
        if os.path.exists(p):
            checked.append(p)
            out = run_cmd([p, "--version"])
            v = parse_version(out)
            if v:
                return v, p, checked
    return None, None, checked


def threshold_for_platform():
    system = platform.system().lower()
    if system == "linux":
        return PATCH_LINUX, "Linux"
    if system == "darwin":
        return PATCH_WIN_MAC, "macOS"
    if system == "windows":
        return PATCH_WIN_MAC, "Windows"
    return PATCH_WIN_MAC, platform.system()


def main():
    explicit = None
    args = sys.argv[1:]
    if "--version" in args:
        try:
            idx = args.index("--version")
            explicit = args[idx + 1]
        except Exception:
            print("UNKNOWN")
            sys.exit(2)

    threshold, os_name = threshold_for_platform()

    version = None
    source = None
    checked = []

    if explicit:
        version = parse_version(explicit)
        source = "--version argument"
    else:
        version, source, checked = find_version_from_commands()
        if not version:
            version, source, checked2 = find_version_from_paths()
            checked.extend(checked2)

    if not version:
        print("UNKNOWN")
        sys.exit(2)

    # CVE-2026-10928 affects Chrome prior to 149.0.7827.53 on Linux
    # and prior to 149.0.7827.53/.54 on Windows/macOS.
    # We use 149.0.7827.54 as the conservative patched threshold on Windows/macOS.
    if cmp_version(version, threshold) < 0:
        print("VULNERABLE")
        sys.exit(1)
    else:
        print("PATCHED")
        sys.exit(0)


if __name__ == "__main__":
    main()

Sources

1. Chrome Releases - Early Stable Update for Desktop
2. Chrome Headless mode documentation
3. Puppeteer headless mode guide
4. Canadian Centre for Cyber Security advisory AV26-544
5. CISA Known Exploited Vulnerabilities Catalog
6. FIRST EPSS overview
7. Quanteta CVE entry showing CVSS/vendor metadata