Inappropriate implementation in Input in Google Chrome prior to 149

CVE-2026-10938 affects Google Chrome prior to 149.0.7827.53 on Linux and prior to 149.0.7827.53/54 on Windows and macOS. The user-supplied title says *"Inappropriate implementation in Input"*, but Google’s June 2, 2026 stable-channel advisory lists it as *"Insufficient validation of untrusted input in Input"* and tags it High in Chromium’s internal severity language. The important part is the attack precondition: the attacker must already have compromised the renderer process before this bug matters.

In practice, that makes this a post-initial-compromise browser chain component, not a stand-alone drive-by. Vendor-style wording can make these look scarier than they usually are in enterprise triage because *site-isolation/sandbox-boundary* bugs sit behind another exploit stage. Still, this is not ignorable: if an attacker already has renderer code execution, a boundary-bypass in Chrome can turn a contained foothold into cross-origin data access or a stronger follow-on position. That keeps it above LOW, but the renderer-compromise prerequisite drags it down to = ASSESSED AT MEDIUM.

Why this verdict

• Big downgrade for attacker position — exploitation requires a compromised renderer process, which implies the attacker has already landed a separate browser exploit stage. That sharply narrows real-world reach versus a normal unauthenticated web RCE.
• Still a real security boundary issue — once chained, this can undermine site isolation / containment and expose higher-value browser session data. On a workforce fleet full of SSO sessions, that is materially useful to an operator.
• Threat intel is cool, not hot — no KEV, no public PoC found, and EPSS is only 0.00021. That is weak evidence for broad near-term exploitation pressure.

Why not higher?

It is not higher because this is not a one-bug compromise path. Requiring prior renderer compromise means the attacker is already inside Chrome’s sandbox lane, so the reachable population is the subset of users who are also vulnerable to a separate stage-one exploit and are worth chaining against.

Why not lower?

It is not lower because site-isolation and browser-boundary bypasses are valuable once a browser foothold exists. In enterprises, a chained browser exploit can expose live SaaS sessions, tokens, and cross-origin data that materially increase attacker payoff even without host-level code execution.

1. Force browser auto-update — Remove version pinning, stale rings, and broken updater states so Chrome can move to patched builds quickly. For a MEDIUM verdict there is no noisgate mitigation SLA; treat this as standard hygiene and complete patch rollout within the 365-day remediation window, though browser fleets should normally converge far sooner.
2. Keep site isolation and Chrome hardening defaults enabled — Do not relax Chrome security flags, enterprise policies, or sandbox-related settings to accommodate legacy apps. There is no mitigation SLA for MEDIUM, so do this in the next normal hardening cycle while still remediating with the vendor-fixed version inside 365 days.
3. Prioritize with any concurrent Chrome renderer-RCE findings — This CVE is most dangerous as part of a chain, so if your backlog also includes Chrome renderer execution bugs, treat the pair as higher operational risk than either ticket alone. There is no mitigation SLA for MEDIUM here, but chain-aware patch grouping should happen during your next browser maintenance wave, not as an isolated long-tail exception.
4. Hunt for outdated or unmanaged Chrome installs — Developer workstations, VDI gold images, kiosk systems, and non-standard packaging channels are where browser drift hides. Because this verdict is MEDIUM, there is no mitigation SLA — go straight to the 365-day remediation window, but unmanaged browsers should be cleaned up in routine asset hygiene much earlier.

Run this on the target endpoint or through your endpoint management agent, not from an auditor workstation. Invoke it with python3 chrome_cve_2026_10938_check.py on macOS/Linux or py chrome_cve_2026_10938_check.py on Windows; standard user rights are usually enough because it only reads local install metadata and runs --version.

#!/usr/bin/env python3
# CVE-2026-10938 Chrome version check
# Outputs: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import shutil
import subprocess
import sys
from pathlib import Path

PATCH_MIN = (149, 0, 7827, 53)
VERSION_RE = re.compile(r'(\d+)\.(\d+)\.(\d+)\.(\d+)')


def parse_version(text):
    m = VERSION_RE.search(text or '')
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def run_version(cmd):
    try:
        p = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, timeout=10)
        out = (p.stdout or '') + '\n' + (p.stderr or '')
        return parse_version(out), out.strip()
    except Exception:
        return None, ''


def candidate_paths():
    system = platform.system().lower()
    paths = []

    if system == 'windows':
        envs = [
            os.environ.get('PROGRAMFILES'),
            os.environ.get('PROGRAMFILES(X86)'),
            os.environ.get('LOCALAPPDATA'),
        ]
        suffixes = [
            r'Google\Chrome\Application\chrome.exe',
            r'Chromium\Application\chrome.exe',
        ]
        for base in envs:
            if not base:
                continue
            for suffix in suffixes:
                paths.append(str(Path(base) / suffix))

    elif system == 'darwin':
        paths.extend([
            '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
            '/Applications/Chromium.app/Contents/MacOS/Chromium',
            str(Path.home() / 'Applications/Google Chrome.app/Contents/MacOS/Google Chrome'),
            str(Path.home() / 'Applications/Chromium.app/Contents/MacOS/Chromium'),
        ])

    else:
        for name in ['google-chrome', 'google-chrome-stable', 'chromium', 'chromium-browser', 'chrome']:
            found = shutil.which(name)
            if found:
                paths.append(found)
        paths.extend([
            '/usr/bin/google-chrome',
            '/usr/bin/google-chrome-stable',
            '/usr/bin/chromium',
            '/usr/bin/chromium-browser',
            '/snap/bin/chromium',
            '/opt/google/chrome/chrome',
        ])

    # de-duplicate while preserving order
    seen = set()
    uniq = []
    for p in paths:
        if p and p not in seen:
            uniq.append(p)
            seen.add(p)
    return uniq


def compare_version(v):
    return v >= PATCH_MIN


def main():
    tested = []
    found_any = False

    for path in candidate_paths():
        if os.path.exists(path) or shutil.which(path):
            found_any = True
            version, raw = run_version([path, '--version'])
            tested.append((path, version, raw))
            if version is not None:
                if compare_version(version):
                    print(f'PATCHED - {path} - version {".".join(map(str, version))}')
                    sys.exit(0)
                else:
                    print(f'VULNERABLE - {path} - version {".".join(map(str, version))}')
                    sys.exit(1)

    if not found_any:
        print('UNKNOWN - Chrome/Chromium executable not found in common locations')
        sys.exit(2)

    # Found something but could not parse any version
    print('UNKNOWN - Found browser executable(s) but could not parse version')
    for path, version, raw in tested:
        msg = raw.replace('\n', ' ').strip()
        if len(msg) > 120:
            msg = msg[:117] + '...'
        print(f'INFO - {path} - raw output: {msg}')
    sys.exit(2)


if __name__ == '__main__':
    main()

Sources

1. Chrome Releases June 2026 archive
2. Canadian Centre for Cyber Security advisory AV26-544
3. CISA Known Exploited Vulnerabilities Catalog
4. FIRST EPSS API lookup for CVE-2026-10938
5. FIRST EPSS overview
6. Chromium issue 502681591
7. Singapore CSA bulletin, 03 Jun 2026
8. Chrome Enterprise previous release notes