Insufficient validation of untrusted input in Dawn in Google Chrome on Windows prior to 149

CVE-2026-10968 is an improper input validation bug in Chrome's Dawn component on Windows that affects Google Chrome versions before 149.0.7827.53. The bug does not give an attacker first-hop code execution by itself; it lets an attacker who has already compromised the renderer process use a crafted HTML page to leak cross-origin data, meaning this is a browser security-boundary failure after an earlier compromise stage has already happened.

Google/NVD rated it HIGH 7.4, which is fair in a pure browser-chain sense because Chrome explicitly models defense against compromised renderers. For enterprise patch triage, though, that overstates the Monday-morning urgency: the decisive friction is the prerequisite of a pre-compromised renderer, which means the attacker already landed another browser exploit or equivalent renderer-native code execution first. That pushes this down from stand-alone urgent patching into chain-hardening.

Why this verdict

• Major downward adjustment: requires compromised renderer first — attacker position is not unauthenticated remote in the real world; it implies a prior browser exploit or equivalent native control inside the sandbox.
• Windows-only scope narrows the population — this is not your whole Chrome estate if you run mixed Windows/macOS/Linux fleets.
• Impact is data leakage, not host takeover — confidentiality can be serious, but there is no direct integrity or availability impact and no evidence here of sandbox escape or persistence.
• No KEV, no public exploitation, ultra-low EPSS — current threat pressure looks low compared with browser bugs that are actively chained in the wild.
• Scanner visibility is easy, exploitability is not — version inventory will show exposure, but the real attack path assumes another exploit stage that most fleets will not routinely face.

Why not higher?

If this were a stand-alone renderer RCE, sandbox escape, or KEV-listed browser zero-day, the answer would move up fast. But this CVE needs a prior renderer compromise and then yields cross-origin data exposure rather than direct system control, which materially limits urgency for broad fleet triage.

Why not lower?

It still matters because Chrome explicitly treats compromised renderers as part of its threat model, and enterprises run a lot of authenticated SaaS sessions in browsers. On high-value users, a post-compromise cross-origin leak can still translate into token theft, data exposure, and follow-on access.

1. Enforce Chrome auto-update — Make sure Windows Chrome is not pinned below 149.0.7827.53 and that Google Update policies allow normal rollout. For a MEDIUM verdict there is no mitigation SLA — go straight to the 365-day remediation window, but this is a routine browser update you should absorb well before that.
2. Prioritize high-value user rings — Push patched Chrome first to admins, executives, developers, and users with privileged SaaS access, because the real business risk is session and data exposure after a chained browser compromise. For MEDIUM, there is no separate mitigation deadline; use your standard browser deployment cadence inside the 365-day remediation window.
3. Harden browser exploit telemetry — Increase attention on Chrome crashes, renderer exploit signals, suspicious child-process behavior, and unusual browser-to-EDR correlations. This does not replace patching, but it is the right control for a bug whose main danger appears only after another exploit stage.
4. Reduce risky browsing paths for sensitive roles — Use isolation, application control, or stricter web filtering for admin and finance populations where feasible. That cuts the chance of the precursor renderer exploit that this CVE depends on.

Run this on the target Windows endpoint or via your endpoint management tool. Invoke with powershell -ExecutionPolicy Bypass -File .\check-chrome-cve-2026-10968.ps1; local admin is not required for version checks, though admin helps if you want all install paths and per-user locations reliably enumerated.

# check-chrome-cve-2026-10968.ps1

# Purpose: Detect whether Google Chrome on Windows is vulnerable to CVE-2026-10968

# Vulnerable if installed version is less than 149.0.7827.53

# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN


$ErrorActionPreference = 'SilentlyContinue'
$fixedVersion = [version]'149.0.7827.53'

function Get-ChromeCandidates {
    $paths = @(
        "$env:ProgramFiles\Google\Chrome\Application\chrome.exe",
        "$env:ProgramFiles(x86)\Google\Chrome\Application\chrome.exe",
        "$env:LocalAppData\Google\Chrome\Application\chrome.exe"
    )

    $regPaths = @(
        'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe',
        'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe',
        'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe'
    )

    foreach ($rp in $regPaths) {
        $reg = Get-ItemProperty -Path $rp
        if ($reg -and $reg.'(default)') { $paths += $reg.'(default)' }
        if ($reg -and $reg.Path) { $paths += (Join-Path $reg.Path 'chrome.exe') }
    }

    $paths | Where-Object { $_ -and (Test-Path $_) } | Select-Object -Unique
}

function Get-FileVersion([string]$path) {
    try {
        return [version](Get-Item $path).VersionInfo.FileVersion
    } catch {
        return $null
    }
}

$candidates = Get-ChromeCandidates
if (-not $candidates -or $candidates.Count -eq 0) {
    Write-Output 'UNKNOWN: chrome.exe not found in common paths or registry.'
    exit 2
}

$results = @()
foreach ($c in $candidates) {
    $ver = Get-FileVersion -path $c
    if ($ver) {
        $results += [pscustomobject]@{
            Path = $c
            Version = $ver
            Status = if ($ver -lt $fixedVersion) { 'VULNERABLE' } else { 'PATCHED' }
        }
    }
}

if (-not $results -or $results.Count -eq 0) {
    Write-Output 'UNKNOWN: Chrome located, but version could not be determined.'
    exit 2
}

$results | Sort-Object Path | ForEach-Object {
    Write-Output ("{0}: {1} [{2}]" -f $_.Status, $_.Path, $_.Version)
}

if ($results.Status -contains 'VULNERABLE') {
    Write-Output 'VULNERABLE'
    exit 1
}

Write-Output 'PATCHED'
exit 0

Sources

1. NVD CVE-2026-10968
2. GitHub Advisory Database GHSA-55cp-fwh4-vq8q
3. Chrome Releases - Early Stable Update for Desktop
4. Chromium Docs - Threat Model And Defenses Against Compromised Renderers
5. Chromium - Chrome sandbox diagnostics for Windows
6. Chrome Enterprise Help - Manage Chrome updates (Windows)
7. FIRST EPSS API
8. CISA Known Exploited Vulnerabilities Catalog