Type Confusion in V8 in Google Chrome prior to 149

CVE-2026-10935 is a V8 memory-safety bug in Chrome fixed in the Chrome 149 train, affecting versions prior to 149.0.7827.53 on Linux and 149.0.7827.53/.54 on Windows and Mac. The user-supplied title describes it as a type confusion leading to arbitrary code execution inside the Chrome sandbox via a crafted page, but Google's June 2, 2026 stable release notes label CVE-2026-10935 as "Inappropriate implementation in V8". Either way, the practical impact is renderer-process code execution after a user hits attacker-controlled web content.

Google's HIGH 8.8 baseline is technically defensible for a no-auth network-reachable browser memory corruption, but it overstates enterprise urgency when you audit the real path. The decisive friction is that this bug stops at sandboxed browser code execution and still needs user navigation to hostile content; without active exploitation, a public PoC, or a paired sandbox escape, this is not in the same patch queue as edge-device pre-auth RCE or KEV-listed browser zero-days.

Why this verdict

• Downgrade for sandbox confinement: successful code execution is described inside the Chrome sandbox, which sharply reduces immediate host-compromise blast radius versus a full browser-to-OS chain.
• Downgrade for attacker path friction: this requires user interaction with malicious content, so it is not directly reachable like an edge service or pre-auth server bug.
• Downgrade for missing threat signals: no KEV listing, no public PoC found, and the provided EPSS is very low (0.00081).
• Partial upward pressure for ubiquity: Chrome is everywhere in enterprise, so even a sandboxed renderer bug can matter at scale if it later gets chained.
• Hold above LOW because of bug class: V8 memory-corruption issues are historically valuable to serious operators, and browser attack surface remains high-value even when a single CVE is not enough on its own.

Why not higher?

There is no verified in-the-wild exploitation signal here, no KEV listing, and no public exploit artifact found during review. More importantly, the described impact is sandboxed renderer execution, which means an attacker still needs additional steps to turn this into a workstation compromise or broad enterprise incident.

Why not lower?

This is still a remotely delivered browser memory-safety flaw in a massively deployed application with no authentication requirement. If your environment has unmanaged browsers, delayed auto-update, or high-risk user populations, the operational exposure is real even without proof of active abuse.

1. Force browser auto-update — Verify Chrome auto-update is enabled and not broken by software distribution controls, then sweep for stragglers. For a MEDIUM verdict there is no mitigation SLA — go straight to the 365-day remediation window, but for browsers you should still collapse drift quickly as routine hygiene.
2. Harden web delivery controls — Keep Safe Browsing, secure DNS, URL filtering, and attachment/link detonation enabled to cut off the delivery step before exploit code runs. This is the best compensating layer while remediation rolls through the fleet, and for MEDIUM severity it should be maintained as standard control coverage rather than rushed under a mitigation SLA.
3. Prioritize high-risk user rings — Put admins, finance, execs, developers, and threat-facing roles into the fastest browser-update ring because they are more likely to encounter targeted lures. Even without a mitigation SLA, those users should not sit in long-tail update backlog.
4. Watch for browser-to-child-process anomalies — Tune EDR detections for chrome spawning unusual children, command shells, script hosts, or LOLBins. This does not prevent the renderer exploit, but it does help catch the moment an attacker tries to convert browser foothold into something useful.

Run this on the target endpoint or through your software inventory agent. Invoke it with python3 check_chrome_cve_2026_10935.py or point it at a specific binary with python3 check_chrome_cve_2026_10935.py --path "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome"; standard user rights are usually enough, though some Windows inventory paths may be easier with local read access.

#!/usr/bin/env python3
# check_chrome_cve_2026_10935.py
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import argparse
import os
import platform
import re
import shutil
import subprocess
import sys
from pathlib import Path

THRESHOLD = (149, 0, 7827, 53)

COMMON_PATHS = {
    "Windows": [
        r"C:\Program Files\Google\Chrome\Application\chrome.exe",
        r"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe",
    ],
    "Darwin": [
        "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome",
        str(Path.home() / "Applications/Google Chrome.app/Contents/MacOS/Google Chrome"),
    ],
    "Linux": [
        "/usr/bin/google-chrome",
        "/usr/bin/google-chrome-stable",
        "/opt/google/chrome/chrome",
        "/snap/bin/chromium",
    ],
}

VERSION_RE = re.compile(r"(\d+)\.(\d+)\.(\d+)\.(\d+)")


def parse_version(text):
    m = VERSION_RE.search(text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def get_version_from_binary(binary):
    try:
        out = subprocess.check_output([binary, "--version"], stderr=subprocess.STDOUT, text=True, timeout=10)
        return parse_version(out), out.strip()
    except Exception:
        return None, ""


def discover_candidates(explicit_path=None):
    candidates = []
    if explicit_path:
        candidates.append(explicit_path)

    system = platform.system()
    for p in COMMON_PATHS.get(system, []):
        candidates.append(p)

    for name in ["google-chrome", "google-chrome-stable", "chrome", "chromium", "chromium-browser"]:
        found = shutil.which(name)
        if found:
            candidates.append(found)

    seen = set()
    unique = []
    for c in candidates:
        if c and c not in seen:
            seen.add(c)
            unique.append(c)
    return unique


def main():
    parser = argparse.ArgumentParser(description="Check Chrome exposure for CVE-2026-10935")
    parser.add_argument("--path", help="Optional explicit path to Chrome binary")
    args = parser.parse_args()

    candidates = discover_candidates(args.path)
    results = []

    for candidate in candidates:
        if os.path.exists(candidate):
            ver, raw = get_version_from_binary(candidate)
            if ver:
                results.append((candidate, ver, raw))

    if not results:
        print("UNKNOWN - Google Chrome binary not found or version unreadable")
        sys.exit(2)

    # Pick highest version found on host.
    results.sort(key=lambda x: x[1], reverse=True)
    path, version, raw = results[0]

    if version < THRESHOLD:
        print(f"VULNERABLE - {raw} at {path} is below 149.0.7827.53")
        sys.exit(1)
    else:
        print(f"PATCHED - {raw} at {path} is at or above 149.0.7827.53")
        sys.exit(0)


if __name__ == "__main__":
    main()

Sources

1. Google Chrome Releases - Stable Channel Update for Desktop (2026-06-02)
2. Google Chrome Releases - Early Stable Update for Desktop (2026-05-29)
3. Google Chrome Releases - Chrome for Android Update (2026-06-02)
4. Chromium Security
5. CISA Known Exploited Vulnerabilities Catalog
6. FIRST EPSS Model
7. FIRST EPSS FAQ
8. NVD CVE Detail