Uninitialized Use in Codecs in Google Chrome prior to 149

CVE-2026-10960 is an uninitialized-use bug in Chrome's Codecs component affecting Google Chrome versions prior to 149.0.7827.53 on Linux and 149.0.7827.53/.54 on Windows/macOS. The published description is unusually important here: the attacker must already have *compromised the renderer process* and then use a crafted HTML page to try to turn that foothold into a sandbox escape.

Google's HIGH label is technically understandable because a browser sandbox escape can convert a renderer compromise into broader system impact. But for enterprise patch triage, the vendor score overstates standalone urgency: this CVE is not a clean pre-auth remote browser takeover by itself, has no known public exploit chain, is not KEV-listed, and carries a very low EPSS, so the real-world severity drops once you audit the prerequisites.

Why this verdict

• Major downward adjustment: requires prior renderer compromise — attacker position is not simple unauthenticated remote web access in practice; it implies a separate exploit, prior code execution, or a private chain already in hand.
• Population narrowing — Chrome is ubiquitous, but this step is only reachable against endpoints that are both unpatched *and* hit by a working renderer exploit, which cuts real exposed population far below the raw install base.
• Threat intel is quiet — no KEV entry, no public PoC identified, and EPSS is extremely low, all of which argue against treating this as a top-of-queue emergency on its own.
• Still not low — if chained, a sandbox escape is exactly the kind of primitive that turns a browser foothold into material endpoint risk, so it remains worth patching in normal browser maintenance.

Why not higher?

Because the attack path starts with a hidden tax: the adversary already needs renderer compromise. That means this CVE is not a one-bug internet-to-host event, not broadly reachable from the open web by commodity actors, and not supported by current exploitation evidence. In enterprise prioritization terms, those are compounding friction points that pull it out of the HIGH bucket.

Why not lower?

Because browser sandbox escapes are strategically valuable even when chain-dependent. Chrome is widely deployed, the vulnerable component sits in an attacker-influenced content path, and a successful escape can materially raise impact from a contained browser exploit to a real endpoint incident. That keeps it above backlog-only hygiene.

1. Force browser auto-update compliance — Validate that enterprise policy is actually pulling Chrome to 149.0.7827.53/.54+ and that stalled update cohorts are remediated. For a MEDIUM verdict there is no mitigation SLA — go straight to the 365-day remediation window, but for browsers you should close drift in the next routine endpoint maintenance cycle rather than letting exceptions linger.
2. Harden browser isolation for high-risk users — Use remote/browser isolation or stronger application containment for admins, developers, executives, and users handling sensitive SaaS sessions. This reduces the value of renderer-to-host exploit chaining while patching rolls through; with MEDIUM, use it as targeted risk reduction rather than an emergency fleet-wide control.
3. Watch for crash and exploit-protection telemetry — Collect Chrome crash spikes, EDR exploit-mitigation alerts, and suspicious browser-child-process behavior on endpoints that have not yet updated. This does not replace patching, but it helps you spot whether a chain is being tested before you complete normal remediation.
4. Reduce privileged browsing — Keep users out of local admin and separate admin workflows from daily browsing. Even if a browser chain lands, lower endpoint privilege reduces post-escape payoff; enforce during ordinary endpoint hardening work, not as a special emergency motion.

Run this on the target endpoint or through your software inventory agent. Invoke with python3 chrome_cve_2026_10960_check.py on Windows, macOS, or Linux; no admin rights are required for basic local checks, though reading some install locations may work better with standard software-inventory permissions.

#!/usr/bin/env python3
# CVE-2026-10960 Chrome version check
# Outputs one of: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import shutil
import subprocess
import sys
from pathlib import Path

TARGET_LINUX = (149, 0, 7827, 53)
TARGET_WIN_MAC = (149, 0, 7827, 53)  # .53/.54 are fixed; >= .53 is treated as patched


def parse_version(text):
    if not text:
        return None
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def version_ge(a, b):
    return a >= b


def run_cmd(cmd):
    try:
        p = subprocess.run(cmd, capture_output=True, text=True, timeout=10)
        out = (p.stdout or '') + '\n' + (p.stderr or '')
        return out.strip()
    except Exception:
        return ''


def find_windows_version():
    candidates = [
        os.path.expandvars(r'%ProgramFiles%\Google\Chrome\Application\chrome.exe'),
        os.path.expandvars(r'%ProgramFiles(x86)%\Google\Chrome\Application\chrome.exe'),
        os.path.expandvars(r'%LocalAppData%\Google\Chrome\Application\chrome.exe'),
    ]

    # Try registry first
    reg_queries = [
        ["reg", "query", r"HKLM\Software\Google\Chrome\BLBeacon", "/v", "version"],
        ["reg", "query", r"HKCU\Software\Google\Chrome\BLBeacon", "/v", "version"],
        ["reg", "query", r"HKLM\Software\WOW6432Node\Google\Chrome\BLBeacon", "/v", "version"],
    ]
    for cmd in reg_queries:
        out = run_cmd(cmd)
        v = parse_version(out)
        if v:
            return v, 'registry'

    for path in candidates:
        if os.path.exists(path):
            out = run_cmd([path, '--version'])
            v = parse_version(out)
            if v:
                return v, path

    return None, ''


def find_macos_version():
    app = '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'
    if os.path.exists(app):
        out = run_cmd([app, '--version'])
        v = parse_version(out)
        if v:
            return v, app

    plist = '/Applications/Google Chrome.app/Contents/Info.plist'
    if os.path.exists(plist):
        out = run_cmd(['/usr/bin/defaults', 'read', plist, 'CFBundleShortVersionString'])
        v = parse_version(out)
        if v:
            return v, plist

    return None, ''


def find_linux_version():
    bins = [
        'google-chrome',
        'google-chrome-stable',
        'chromium',
        'chromium-browser',
    ]
    for b in bins:
        path = shutil.which(b)
        if path:
            out = run_cmd([path, '--version'])
            v = parse_version(out)
            if v:
                return v, path

    common = [
        '/opt/google/chrome/chrome',
        '/usr/bin/google-chrome',
        '/usr/bin/google-chrome-stable',
    ]
    for path in common:
        if os.path.exists(path):
            out = run_cmd([path, '--version'])
            v = parse_version(out)
            if v:
                return v, path

    return None, ''


def main():
    system = platform.system().lower()

    if 'windows' in system:
        version, source = find_windows_version()
        threshold = TARGET_WIN_MAC
    elif 'darwin' in system or 'mac' in system:
        version, source = find_macos_version()
        threshold = TARGET_WIN_MAC
    elif 'linux' in system:
        version, source = find_linux_version()
        threshold = TARGET_LINUX
    else:
        print('UNKNOWN: unsupported platform')
        sys.exit(2)

    if not version:
        print('UNKNOWN: Google Chrome version not found')
        sys.exit(2)

    if version_ge(version, threshold):
        print(f'PATCHED: detected version {".".join(map(str, version))} from {source}')
        sys.exit(0)
    else:
        print(f'VULNERABLE: detected version {".".join(map(str, version))} from {source}')
        sys.exit(1)


if __name__ == '__main__':
    main()

Sources

1. Chrome Releases: Stable Channel Update for Desktop (June 2, 2026)
2. NVD entry for CVE-2026-10960
3. Chromium issue 507258786 (restricted bug reference)
4. Canadian Centre for Cyber Security advisory AV26-544
5. CISA Known Exploited Vulnerabilities Catalog
6. FIRST EPSS overview
7. Shodan Internet Exposure Observatory
8. Censys Search product overview