Integer overflow in V8 in Google Chrome prior to 149

CVE-2026-10963 is an integer overflow in Chrome’s V8 JavaScript engine. Google/NVD describe affected versions as Google Chrome prior to 149.0.7827.53, with the stable release fixing Linux at 149.0.7827.53 and Windows/Mac at 149.0.7827.53/.54. The trigger is a crafted HTML page, so the initial exploit path is ordinary web content rendered in a Chrome renderer process.

The vendor’s HIGH 8.8 is directionally fair on reachability, but it overstates enterprise impact if read as full-host RCE. The key limiter is right in the description: code execution is *inside a sandbox*. That means this CVE alone is usually a renderer compromise, not workstation takeover, and real damage often requires a second bug, a sandbox escape, token theft, or user-data abuse.

Why this verdict

• Downgrade for sandboxed impact: the vendor text itself says code execution occurs *inside a sandbox*, which is materially weaker than full workstation takeover.
• Downward pressure from UI:R: the attacker needs the user to render hostile content, so this is not wormable and not a spray-the-internet service exploit.
• Reachability keeps it out of MEDIUM: Chrome is everywhere, and the initial attack position is unauthenticated remote over the web, so the exposure population is huge even if final impact is bounded.
• No exploitation signal: not KEV-listed, no Google zero-day flag in the release note, no public PoC found in reviewed primary sources, and the supplied EPSS (0.0008) is very low.
• Modern controls partially help, but don’t erase risk: Safe Browsing, web filtering, EDR, and enterprise auto-update reduce success rates, yet none reliably stops a fresh browser exploit every time.

Why not higher?

This is not a clean unauthenticated service-side RCE on a server tier, and it is not documented as actively exploited. The attack still needs user interaction and, on the facts available, lands in the renderer sandbox rather than breaking straight to host-level code execution.

Why not lower?

Browsers are one of the largest exposed attack surfaces in the enterprise, and a crafted web page is a very low-friction initial lure. Even sandboxed renderer code execution can still enable credential/session theft, browser-state abuse, or pairing with a second bug for full compromise.

1. Force browser auto-update compliance — Use your browser management plane to ensure Chrome reaches 149.0.7827.53 or later everywhere; for a HIGH verdict, drive this control deployment within 30 days. This is the highest-value mitigation because this bug is fundamentally version-gated.
2. Block unmanaged or stale Chrome builds — Use device compliance policy, software restriction, or NAC posture checks to deny outdated browsers access to sensitive SaaS and internal apps. Deploy within 30 days so the remaining long-tail endpoints stop carrying interactive web exploit risk into high-value sessions.
3. Tighten risky web paths — Use secure web gateway categories, ad-blocking, Safe Browsing enforcement, and phishing-resistant browsing policies to cut off common delivery routes for crafted HTML exploit pages. Roll this out within 30 days as a practical exposure reducer while patch rollout finishes.
4. Watch for browser-to-OS pivot behavior — Tune EDR detections for suspicious child processes, DLL loads, and token/session theft behavior originating from Chrome. Put this in place within 30 days because the main residual risk is not the renderer bug itself but the follow-on chain.
5. Protect browser-backed sessions — Prioritize MFA, short session lifetimes, re-auth for admin actions, and conditional access on privileged web apps. Implement or validate these controls within 30 days because they reduce the payoff of a renderer compromise that harvests browser-accessible state.

Run this on the target endpoint or through your endpoint management agent; it needs only normal user privileges. Example: python3 check_cve_2026_10963.py or python check_cve_2026_10963.py --chrome-version 149.0.7827.52 if you want to test a version string directly.

#!/usr/bin/env python3
# CVE-2026-10963 Chrome version check
# Outputs exactly one of: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import shutil
import subprocess
import sys

FIXED = (149, 0, 7827, 53)


def parse_ver(s):
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', s or '')
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def ver_to_str(v):
    return '.'.join(str(x) for x in v)


def is_patched(v):
    return v >= FIXED


def run_cmd(cmd):
    try:
        p = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, timeout=10)
        out = (p.stdout or '') + ' ' + (p.stderr or '')
        return out.strip()
    except Exception:
        return ''


def windows_candidates():
    paths = []
    for base in [os.environ.get('ProgramFiles'), os.environ.get('ProgramFiles(x86)'), os.environ.get('LocalAppData')]:
        if not base:
            continue
        paths.append(os.path.join(base, 'Google', 'Chrome', 'Application', 'chrome.exe'))
    return [p for p in paths if p and os.path.exists(p)]


def mac_candidates():
    paths = [
        '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
        os.path.expanduser('~/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'),
    ]
    return [p for p in paths if os.path.exists(p)]


def linux_candidates():
    names = ['google-chrome', 'google-chrome-stable', 'chromium', 'chromium-browser']
    found = []
    for n in names:
        p = shutil.which(n)
        if p:
            found.append(p)
    return found


def get_versions_from_paths(paths):
    versions = []
    for p in paths:
        out = run_cmd([p, '--version'])
        v = parse_ver(out)
        if v:
            versions.append((p, v))
    return versions


def main():
    # Optional direct version input
    if len(sys.argv) == 3 and sys.argv[1] == '--chrome-version':
        v = parse_ver(sys.argv[2])
        if not v:
            print('UNKNOWN')
            sys.exit(2)
        if is_patched(v):
            print('PATCHED')
            sys.exit(0)
        else:
            print('VULNERABLE')
            sys.exit(1)

    system = platform.system().lower()
    candidates = []

    if system == 'windows':
        candidates = windows_candidates()
    elif system == 'darwin':
        candidates = mac_candidates()
    else:
        candidates = linux_candidates()

    versions = get_versions_from_paths(candidates)

    if not versions:
        print('UNKNOWN')
        sys.exit(2)

    vulnerable = []
    patched = []
    for path, ver in versions:
        if is_patched(ver):
            patched.append((path, ver))
        else:
            vulnerable.append((path, ver))

    # If any installed Chrome/Chromium found is below fixed, treat host as vulnerable.
    if vulnerable:
        print('VULNERABLE')
        sys.exit(1)
    else:
        print('PATCHED')
        sys.exit(0)


if __name__ == '__main__':
    main()

Sources

1. NVD entry for CVE-2026-10963
2. Google Chrome stable desktop release for version 149
3. Chromium issue 511218177
4. CISA Known Exploited Vulnerabilities Catalog
5. Chromium multi-process architecture
6. Chromium Chrome sandbox diagnostics for Windows
7. FIRST EPSS overview
8. FIRST EPSS API documentation