Insufficient validation of untrusted input in DevTools in Google Chrome prior to 149

CVE-2026-10980 is an input-validation flaw in Chrome DevTools affecting desktop Chrome versions before 149.0.7827.53 on Linux and 149.0.7827.53/.54 on Windows/macOS. The user-supplied title is truncated, but the crucial phrase is there: it says the bug allowed a remote attacker who had compromised something already. That strongly implies this is not a standalone one-click browser compromise; it is a follow-on primitive in a chain, most plausibly after renderer compromise or equivalent browser foothold.

In raw CVSS terms, a browser bug with network reachability and user interaction lands in the middle of the pack. In real enterprise operations, the prior-compromise requirement is the whole story: if the attacker must already own a browser sub-process or comparable state, this is post-initial-access inside the browser, not your first domino. Wide install base keeps it out of LOW, but no KEV entry, no active exploitation evidence, a tiny EPSS, and the chaining requirement pull it down from the supplied 6.5/MEDIUM baseline to a lower-end MEDIUM.

Why this verdict

• Chaining requirement cuts hard: the title says the attacker had already "compromised" a prerequisite component, which makes this post-initial browser exploitation rather than a clean standalone web bug
• User interaction required: the CVSS includes UI:R, so this still depends on getting users onto malicious content
• Blast radius is usually one browser context: even successful exploitation is typically bounded to the victim's browser/user session, not unauthenticated fleet-wide takeover
• Threat intel is cold: no KEV, no public PoC found, and EPSS is effectively near-zero
• Wide deployment prevents a LOWER bucket: Chrome is everywhere, so even chain-only browser bugs deserve patch attention in normal lifecycle hygiene

Why not higher?

There is no public evidence here of active exploitation, no KEV listing, and no sign this can be driven as a one-bug remote compromise. Most importantly, the attack path appears to require a prior browser compromise stage, which is compounding downward pressure on severity in a real enterprise patch queue.

Why not lower?

This still lands on an extremely common endpoint application with daily attacker reach through browsing. If an attacker already has the precursor browser foothold, an integrity-impacting follow-on bug inside Chrome can still improve reliability, bypasses, or session abuse enough to matter at scale.

1. Enforce rapid browser auto-update — Make sure managed Chrome channels are pinned to stable and forced to update without excessive user deferral. For a MEDIUM noisgate verdict there is no mitigation SLA; use this as standard hygiene and complete the actual patch inside the 365-day remediation window, though browsers should normally move much faster operationally.
2. Reduce risky web exposure — Apply SWG/DNS filtering, block newly seen domains where possible, and route high-risk users through browser isolation or stricter web controls. This helps on the delivery step, which is the one reachable stage before the exploit chain needs a much harder prior compromise.
3. Harden Chrome with enterprise policy — Disable unnecessary developer features, restrict remote debugging usage, and enforce security policies through Google enterprise templates. This does not fix the bug, but it trims odd DevTools-adjacent workflows and reduces attacker room to maneuver while you patch.
4. Watch for browser exploit signals — Collect Chrome version inventory, crash spikes, suspicious child-process trees, and identity anomalies tied to browser sessions. Because this looks like a chain element, your best early warning is often the precursor exploit or the follow-on session abuse rather than the CVE itself.

Run this on the target endpoint or via your EDR/script runner, not from an auditor workstation. Invoke with python3 check_chrome_cve_2026_10980.py on macOS/Linux or py check_chrome_cve_2026_10980.py on Windows; no admin rights are usually required, but the script must be able to execute the local Chrome binary or read its version from standard install paths.

#!/usr/bin/env python3
# check_chrome_cve_2026_10980.py
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN

import os
import platform
import re
import shutil
import subprocess
import sys
from typing import Optional, Tuple

TARGET = (149, 0, 7827, 53)


def parse_version(text: str) -> Optional[Tuple[int, int, int, int]]:
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def run_cmd(cmd):
    try:
        p = subprocess.run(cmd, capture_output=True, text=True, timeout=10)
        out = (p.stdout or '') + '\n' + (p.stderr or '')
        return out.strip()
    except Exception:
        return ''


def check_linux() -> Optional[Tuple[int, int, int, int]]:
    candidates = [
        shutil.which('google-chrome'),
        shutil.which('google-chrome-stable'),
        shutil.which('chromium-browser'),
        shutil.which('chromium'),
        '/opt/google/chrome/chrome',
        '/usr/bin/google-chrome',
        '/usr/bin/google-chrome-stable',
    ]
    for path in candidates:
        if path and os.path.exists(path):
            out = run_cmd([path, '--version'])
            ver = parse_version(out)
            if ver:
                return ver
    return None


def check_macos() -> Optional[Tuple[int, int, int, int]]:
    candidates = [
        '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
        os.path.expanduser('~/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'),
    ]
    for path in candidates:
        if os.path.exists(path):
            out = run_cmd([path, '--version'])
            ver = parse_version(out)
            if ver:
                return ver
    return None


def check_windows() -> Optional[Tuple[int, int, int, int]]:
    envs = [
        os.environ.get('ProgramFiles'),
        os.environ.get('ProgramFiles(x86)'),
        os.environ.get('LocalAppData'),
    ]
    candidates = []
    for base in envs:
        if not base:
            continue
        candidates.append(os.path.join(base, 'Google', 'Chrome', 'Application', 'chrome.exe'))

    for path in candidates:
        if os.path.exists(path):
            out = run_cmd([
                'powershell', '-NoProfile', '-Command',
                f"(Get-Item '{path}').VersionInfo.ProductVersion"
            ])
            ver = parse_version(out)
            if ver:
                return ver
            out = run_cmd([path, '--version'])
            ver = parse_version(out)
            if ver:
                return ver
    return None


def compare(ver, target):
    if ver < target:
        return -1
    if ver > target:
        return 1
    return 0


def main():
    system = platform.system().lower()
    version = None

    if 'linux' in system:
        version = check_linux()
    elif 'darwin' in system:
        version = check_macos()
    elif 'windows' in system:
        version = check_windows()
    else:
        print('UNKNOWN: unsupported OS')
        sys.exit(2)

    if not version:
        print('UNKNOWN: Google Chrome not found or version unreadable')
        sys.exit(2)

    print('Detected Chrome version: %s' % '.'.join(map(str, version)))

    cmp_result = compare(version, TARGET)
    if cmp_result < 0:
        print('VULNERABLE')
        sys.exit(1)
    else:
        print('PATCHED')
        sys.exit(0)


if __name__ == '__main__':
    main()

Sources

1. Chrome Releases 2026 index
2. Chrome Stable Channel Update for Desktop (June 2, 2026)
3. Chrome Early Stable Update for Desktop (May 29, 2026)
4. Chrome Security Page
5. CISA Known Exploited Vulnerabilities Catalog
6. FIRST EPSS model documentation
7. Canadian Centre for Cyber Security advisory AV26-544
8. GovCERT.HK alert A26-06-08