Heap buffer overflow in Media in Google Chrome prior to 149

CVE-2026-10946 is a heap buffer overflow in Chrome's Media component affecting Google Chrome before 149.0.7827.53. Google’s desktop stable release notes tie the fix to 149.0.7827.53 on Linux and 149.0.7827.53/.54 on Windows and macOS; Android 149.0.7827.59 carries the same desktop security fixes. The bug is reachable by a remote attacker via crafted web content, but the published description says the victim must be convinced to perform specific UI gestures, which matters a lot in real enterprise exposure.

Google’s HIGH 7.5 label is basically fair, but it slightly overstates immediate enterprise urgency if you read it like a server-side RCE. This is a client-side browser memory corruption bug with high attack complexity, user interaction, and an implied need for the attacker to reliably steer a fragile media path; that is meaningful friction. The counterweight is obvious: Chrome is everywhere, attacker delivery is cheap, and browser memory corruption remains a favored initial-access route, so this stays HIGH, just not drop-everything CRITICAL.

Why this verdict

• Baseline starts high: Chrome is ubiquitous, internet-facing by design, and memory corruption in the browser remains a proven initial-access class.
• Friction adjustment down: the vendor vector already admits AC:H and UI:R, and the narrative adds specific UI gestures. That is a real conversion tax on attacker campaigns.
• No exploitation amplifier: no KEV listing, no public exploitation evidence in reviewed sources, and a very low EPSS remove the main reasons to escalate this toward CRITICAL.

Why not higher?

There is no present evidence of active exploitation, and the trigger is not a simple one-click or zero-click web visit. Also, Chrome’s sandbox and modern exploit mitigations mean a media heap overflow does not automatically translate into dependable host compromise at enterprise scale.

Why not lower?

This is still a remote, attacker-controlled browser content path in one of the most common enterprise applications on earth. If an adversary wants an initial foothold, the browser is exactly where they shop, and memory corruption bugs with user interaction still get chained in real campaigns.

1. Force auto-update — Push Chrome auto-update enforcement through GPO/MDM and verify clients are accepting the 149.0.7827.53+ train. For a HIGH verdict, deploy within 30 days if patching lags.
2. Route risky users through browser isolation — Put internet-facing, high-click populations such as finance, HR, executives, and help desk behind remote browser isolation where available. This reduces host impact if the browser is hit; for a HIGH verdict, put the policy in place within 30 days.
3. Harden media-heavy browsing paths — Use enterprise browser policy to restrict unnecessary media autoplay, limit risky consumer sites where business-justified, and keep Safe Browsing/web filtering at enforcement mode. These controls reduce the chance the required gesture path is reached; deploy within 30 days.
4. Watch for Chrome crash clusters — Create a temporary hunt for repeated chrome crashes or abnormal browser child-process activity on vulnerable builds. This will not detect the exploit reliably, but it gives you a practical early-warning tripwire while patch coverage catches up; stand this up within 30 days.

Run this on the target endpoint or through your EDR/remote management tool as the logged-in user; no admin rights are required. Save as check_chrome_cve_2026_10946.py and run python3 check_chrome_cve_2026_10946.py on macOS/Linux or py check_chrome_cve_2026_10946.py on Windows. It checks common Chrome install paths, reads the local version, and prints VULNERABLE, PATCHED, or UNKNOWN.

#!/usr/bin/env python3
# check_chrome_cve_2026_10946.py
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN

import os
import platform
import re
import subprocess
import sys
from pathlib import Path

THRESHOLD = (149, 0, 7827, 53)

WINDOWS_PATHS = [
    r"C:\Program Files\Google\Chrome\Application\chrome.exe",
    r"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe",
    os.path.expandvars(r"%LOCALAPPDATA%\Google\Chrome\Application\chrome.exe"),
]

MAC_PATHS = [
    "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome",
    str(Path.home() / "Applications/Google Chrome.app/Contents/MacOS/Google Chrome"),
]

LINUX_PATHS = [
    "/usr/bin/google-chrome",
    "/usr/bin/google-chrome-stable",
    "/opt/google/chrome/chrome",
    "/snap/bin/chromium",
]

VERSION_RE = re.compile(r"(\d+)\.(\d+)\.(\d+)\.(\d+)")


def parse_version(text):
    m = VERSION_RE.search(text or "")
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def cmp_ver(a, b):
    return (a > b) - (a < b)


def run_version(binary):
    try:
        proc = subprocess.run([binary, "--version"], capture_output=True, text=True, timeout=10)
        out = (proc.stdout or "") + " " + (proc.stderr or "")
        return parse_version(out)
    except Exception:
        return None


def powershell_file_version(path):
    cmd = [
        "powershell",
        "-NoProfile",
        "-Command",
        f"(Get-Item '{path}').VersionInfo.ProductVersion"
    ]
    try:
        proc = subprocess.run(cmd, capture_output=True, text=True, timeout=10)
        out = (proc.stdout or "") + " " + (proc.stderr or "")
        return parse_version(out)
    except Exception:
        return None


def candidate_paths():
    system = platform.system().lower()
    if system == "windows":
        return WINDOWS_PATHS
    if system == "darwin":
        return MAC_PATHS
    return LINUX_PATHS


def discover_version():
    system = platform.system().lower()
    for p in candidate_paths():
        if p and os.path.exists(p):
            if system == "windows":
                v = powershell_file_version(p) or run_version(p)
            else:
                v = run_version(p)
            if v:
                return p, v
    return None, None


def main():
    path, version = discover_version()
    if not version:
        print("UNKNOWN: Google Chrome not found in common paths or version unreadable")
        sys.exit(2)

    if cmp_ver(version, THRESHOLD) < 0:
        print(f"VULNERABLE: Chrome version {'.'.join(map(str, version))} at {path} is older than 149.0.7827.53")
        sys.exit(1)
    else:
        print(f"PATCHED: Chrome version {'.'.join(map(str, version))} at {path} is 149.0.7827.53 or newer")
        sys.exit(0)


if __name__ == "__main__":
    main()

Sources

1. Google Chrome Releases - Stable Channel Update for Desktop
2. Chrome 149 release notes
3. NVD record for CVE-2026-10946
4. CISA Known Exploited Vulnerabilities catalog JSON
5. FIRST EPSS API
6. Canadian Centre for Cyber Security advisory AV26-544
7. GovCERT.HK alert A26-06-08