Race in Codecs in Google Chrome on Windows prior to 149

CVE-2026-10940 is a race condition in Chrome's Codecs component on Windows that affects versions before 149.0.7827.53. The bug matters because it appears to let an attacker who already has code execution or strong control inside the renderer process use a crafted media path to push past Chrome's sandbox boundary; in plain English, this is not the bug that gets you *into* the browser, it's the bug that may help you get *out of* the renderer jail once you're already there.

Google's HIGH 8.3 label is defensible in a lab because sandbox escapes can turn a browser exploit into host impact, but it overstates fleet urgency for patch prioritization. The decisive real-world friction is the prerequisite: the attacker must first compromise the renderer, which means this CVE is a post-initial-compromise exploit-chain component, not a standalone remote compromise path across 10,000 endpoints.

Why this verdict

• Biggest downgrade: requires renderer compromise first — attacker position is not unauthenticated remote code execution on the host; it implies a prior successful browser exploit and therefore a chained attack, not an entry path.
• Reach is narrower than the vendor score suggests — Windows-only exposure plus a crafted media/codecs path means only a subset of Chrome endpoints and browsing flows are even relevant.
• Threat intel is quiet — no KEV listing, no confirmed public campaigns, and an EPSS of 0.00061 argue against treating this like an internet-scale burn-now item.

Why not higher?

A higher rating would require one of three amplifiers that are missing here: proven in-the-wild exploitation, public weaponization, or a standalone remote compromise path. Instead, this bug starts from a compromised renderer and then asks the attacker to win a race condition on Windows, which is a much smaller and less reliable slice of real-world exposure.

Why not lower?

I am not dropping this to LOW because Chrome is ubiquitous and sandbox escapes are strategically valuable even when they are chain-dependent. If an attacker already has renderer execution, a working escape can materially change the outcome on an endpoint from a contained browser compromise to host-impacting access.

1. Enforce Chrome auto-update and relaunch compliance — Make sure managed Windows endpoints actually move to 149.0.7827.53/54 or later and that users relaunch the browser so the fix is live. For a MEDIUM finding there is no mitigation SLA, so this is an operational hardening step rather than an emergency containment clock.
2. Put high-risk users behind browser isolation — Use remote/browser isolation for admins, developers handling untrusted web content, and users most likely to hit malicious media. This reduces the value of a renderer-to-sandbox chain while you clean up stragglers; for MEDIUM, there is no mitigation SLA — go straight to the remediation window.
3. Separate admin activity from browsing — Keep privileged accounts out of daily web sessions and enforce PAWs or separate admin workstations where possible. Even if this CVE is exploited, lowering the value of the logged-in context sharply reduces post-escape payoff.
4. Watch for browser exploit symptoms — Hunt for Chrome crash bursts, unusual browser child processes, LOLBin launches, token anomalies, and suspicious access to credential stores immediately after browsing activity. This does not prevent exploitation, but it is the control most likely to catch the post-escape phase.

Run this on the target Windows host or through your endpoint management tool. Invoke it with powershell.exe -ExecutionPolicy Bypass -File .\check-chrome-cve-2026-10940.ps1; no admin rights are required because it only reads file and registry metadata. It checks common system- and user-level Chrome install paths and reports VULNERABLE, PATCHED, or UNKNOWN.

# check-chrome-cve-2026-10940.ps1

# Purpose: Detect whether Google Chrome on Windows is older than 149.0.7827.53

# Output: VULNERABLE / PATCHED / UNKNOWN

# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN


$ErrorActionPreference = 'SilentlyContinue'
$fixedVersion = [version]'149.0.7827.53'

function Get-ChromeCandidates {
    $paths = New-Object System.Collections.Generic.List[string]

    $envPaths = @(
        "$env:ProgramFiles\Google\Chrome\Application\chrome.exe",
        "$env:ProgramFiles(x86)\Google\Chrome\Application\chrome.exe",
        "$env:LocalAppData\Google\Chrome\Application\chrome.exe"
    )

    foreach ($p in $envPaths) {
        if ($p -and (Test-Path $p)) { [void]$paths.Add($p) }
    }

    $regKeys = @(
        'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe',
        'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe',
        'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe'
    )

    foreach ($key in $regKeys) {
        $defaultValue = (Get-Item $key).GetValue('')
        if ($defaultValue -and (Test-Path $defaultValue)) { [void]$paths.Add($defaultValue) }
    }

    return $paths | Sort-Object -Unique
}

function Get-FileVersionObject([string]$path) {
    try {
        $fv = (Get-Item $path).VersionInfo.FileVersion
        if (-not $fv) { return $null }
        $parts = ($fv -split '[^0-9]+' | Where-Object { $_ -match '^\d+$' })
        if ($parts.Count -lt 4) { return $null }
        return [version]("{0}.{1}.{2}.{3}" -f $parts[0], $parts[1], $parts[2], $parts[3])
    }
    catch {
        return $null
    }
}

$candidates = Get-ChromeCandidates
if (-not $candidates -or $candidates.Count -eq 0) {
    Write-Output 'UNKNOWN'
    exit 2
}

$foundAnyVersion = $false
$foundVulnerable = $false
$results = @()

foreach ($chrome in $candidates) {
    $ver = Get-FileVersionObject $chrome
    if ($ver -ne $null) {
        $foundAnyVersion = $true
        $state = if ($ver -lt $fixedVersion) { 'VULNERABLE' } else { 'PATCHED' }
        $results += [pscustomobject]@{
            Path    = $chrome
            Version = $ver.ToString()
            State   = $state
        }
        if ($ver -lt $fixedVersion) { $foundVulnerable = $true }
    }
}

if (-not $foundAnyVersion) {
    Write-Output 'UNKNOWN'
    exit 2
}

# Optional detail for management tooling logs

$results | ForEach-Object { Write-Verbose ($_.Path + ' -> ' + $_.Version + ' -> ' + $_.State) }

if ($foundVulnerable) {
    Write-Output 'VULNERABLE'
    exit 1
}
else {
    Write-Output 'PATCHED'
    exit 0
}

Sources

1. Google Chrome Releases - Early Stable Update for Desktop (149.0.7827.53/.54)
2. Google Chrome Releases blog
3. Canadian Centre for Cyber Security advisory AV26-544
4. CISA Known Exploited Vulnerabilities Catalog
5. FIRST EPSS overview
6. FIRST EPSS API documentation
7. Vulnerability-Lookup Chrome June 2026 search results
8. Vulnerability-Lookup Chrome June 2026 search results (additional page)