Insufficient validation of untrusted input in Extensions in Google Chrome prior to 149

CVE-2026-10969 is an input-validation flaw in Chrome's Extensions component affecting Google Chrome versions prior to 149.0.7827.53 on Linux and prior to the 149.0.7827.53/.54 desktop stable build on Windows and macOS. The important caveat is in the description itself: the attacker must already have *compromised the renderer process* and then use a crafted HTML page to cross into more privileged browser territory.

Google marked it HIGH at 7.5, which is fair in a lab because privilege-boundary failures inside a browser exploit chain matter. In enterprise reality, though, this is not a clean unauthenticated remote compromise by itself; it is a *post-renderer-compromise* escalation step with no public exploitation evidence, no KEV listing, and a very low EPSS signal, so the vendor score overstates the Monday-morning urgency.

Why this verdict

• Start from Google's 7.5 baseline because Chrome is everywhere and privilege-boundary failures inside browsers can absolutely matter when chained
• Downgrade hard for attacker position: the attacker must already have compromised the renderer process, which implies a prior exploit stage and makes this a second-stage chain component, not initial access
• Downgrade again for operational signal: no KEV listing, no public exploitation note from Google, and a very low EPSS (0.066%) all argue against fleet-emergency treatment

Why not higher?

If this were a standalone remote code execution or sandbox escape with no prerequisite beyond visiting a page, HIGH would be fair and CRITICAL would be on the table if exploitation showed up. But the renderer-compromise prerequisite is a huge real-world narrowing factor, and that matters more than abstract C/I/A impact.

Why not lower?

Chrome is ubiquitous, and browser exploit chains are still one of the most practical ways to land on endpoints. A privilege-escalation step that helps an attacker escape renderer restrictions can materially change the outcome of a targeted campaign, so this is not backlog junk.

1. Enforce Chrome auto-update and relaunch compliance — Use enterprise policy and device management to keep Chrome on the stable patched build and to force or strongly prompt relaunch for long-running sessions. For a MEDIUM verdict there is no mitigation SLA; use this as part of the normal remediation window rather than an emergency control.
2. Tighten extension install policy — Restrict extension installation to an allowlist and remove unnecessary extensions to reduce reachable extensions-related attack surface. Again, for MEDIUM there is no mitigation SLA; do it within the standard remediation program if your fleet cannot update promptly.
3. Apply browser isolation to high-risk users — Put admins, executives, researchers, and users who routinely browse untrusted content behind remote browser isolation or hardened browsing profiles. This helps at the delivery and renderer-compromise stages, which is where this chain is most likely to be broken.
4. Hunt for browser exploit signals — Review EDR telemetry for Chrome crashes, suspicious child processes, and abnormal access to browser profile data following untrusted web activity. This will not prove CVE-2026-10969 specifically, but it is where defenders have the best chance of seeing the chain.

Run this on the target endpoint or through your EDR/remote-exec tooling, not from an auditor workstation. Invoke it with python3 check_chrome_cve_2026_10969.py on macOS/Linux or py check_chrome_cve_2026_10969.py on Windows; no admin rights are normally required, but access to standard install paths is needed.

#!/usr/bin/env python3
# Check Google Chrome version for CVE-2026-10969
# Outputs one of: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import shutil
import subprocess
import sys
from typing import List, Optional, Tuple

THRESHOLD = (149, 0, 7827, 53)
VERSION_RE = re.compile(r'(\d+)\.(\d+)\.(\d+)\.(\d+)')


def parse_version(text: str) -> Optional[Tuple[int, int, int, int]]:
    m = VERSION_RE.search(text or '')
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def version_to_str(v: Tuple[int, int, int, int]) -> str:
    return '.'.join(str(x) for x in v)


def run_and_get_version(cmd: List[str]) -> Optional[Tuple[int, int, int, int]]:
    try:
        proc = subprocess.run(cmd, capture_output=True, text=True, timeout=5)
        out = (proc.stdout or '') + ' ' + (proc.stderr or '')
        return parse_version(out)
    except Exception:
        return None


def candidate_commands() -> List[List[str]]:
    cmds = []
    system = platform.system().lower()

    if system == 'windows':
        paths = [
            os.path.join(os.environ.get('ProgramFiles', r'C:\\Program Files'), 'Google', 'Chrome', 'Application', 'chrome.exe'),
            os.path.join(os.environ.get('ProgramFiles(x86)', r'C:\\Program Files (x86)'), 'Google', 'Chrome', 'Application', 'chrome.exe'),
            os.path.join(os.environ.get('LocalAppData', ''), 'Google', 'Chrome', 'Application', 'chrome.exe'),
        ]
        for p in paths:
            if p and os.path.exists(p):
                cmds.append([p, '--version'])
    elif system == 'darwin':
        mac_path = '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'
        if os.path.exists(mac_path):
            cmds.append([mac_path, '--version'])
        if shutil.which('google-chrome'):
            cmds.append(['google-chrome', '--version'])
    else:
        for name in ['google-chrome', 'google-chrome-stable', '/usr/bin/google-chrome', '/usr/bin/google-chrome-stable']:
            if name.startswith('/'):
                if os.path.exists(name):
                    cmds.append([name, '--version'])
            elif shutil.which(name):
                cmds.append([name, '--version'])

    return cmds


def main() -> int:
    found_versions = []
    for cmd in candidate_commands():
        v = run_and_get_version(cmd)
        if v:
            found_versions.append((cmd[0], v))

    if not found_versions:
        print('UNKNOWN: Google Chrome not found or version unreadable')
        return 2

    vulnerable = []
    patched = []
    for path, ver in found_versions:
        if ver < THRESHOLD:
            vulnerable.append((path, ver))
        else:
            patched.append((path, ver))

    if vulnerable:
        details = '; '.join(f'{path}={version_to_str(ver)}' for path, ver in vulnerable)
        print(f'VULNERABLE: {details} (fixed at {version_to_str(THRESHOLD)} or later)')
        return 1

    if patched:
        details = '; '.join(f'{path}={version_to_str(ver)}' for path, ver in patched)
        print(f'PATCHED: {details}')
        return 0

    print('UNKNOWN: unable to classify installed Chrome version')
    return 2


if __name__ == '__main__':
    sys.exit(main())

Sources

1. GitHub Advisory Database - GHSA-9crv-2mc9-w5vj
2. Chrome Releases - Stable Channel Update for Desktop (June 2, 2026)
3. Chrome 149 release notes
4. Chromium Security overview
5. Chromium issue 511765713
6. CISA Known Exploited Vulnerabilities Catalog
7. FIRST EPSS API documentation
8. NVD entry for CVE-2026-10969