Insufficient validation of untrusted input in Codecs in Google Chrome prior to 149

CVE-2026-10981 is an input-validation bug in Chrome's Codecs component. It affects Chrome versions before 149.0.7827.53 on Linux and the 149.0.7827.53/.54 stable train on Windows/macOS; the practical abuse case is a crafted video payload that helps an attacker cross Chrome's sandbox boundary.

paragraph 2: Google's MEDIUM 6.5 label is defensible in a lab, but it overstates the standalone operational risk for enterprise patch queues. The decisive real-world friction is that this is a *chain* bug: the attacker typically needs a separate renderer foothold plus user interaction with attacker-controlled media, and there is no KEV listing, no public exploit, and a very low EPSS signal.

Why this verdict

• Baseline starts at vendor MEDIUM 6.5 because Chrome is ubiquitous and codec bugs live on a hostile content path
• Renderer-compromise prerequisite drags it down hard: the attacker position is effectively *post-initial-browser-compromise*, which means this is not a front-door exploit for most enterprises
• User interaction narrows reach further: the victim still has to render attacker-controlled media, so email/web filtering and user behavior matter
• No exploitation heat: no KEV, no public PoC, and a supplied EPSS of 0.00047 all argue against urgent opportunistic abuse
• Broad install base keeps it above IGNORE: Chrome is everywhere, and sandbox escapes remain strategically valuable when paired with another browser bug

Why not higher?

If this were a standalone renderer RCE with reliable remote trigger, the score would jump immediately. But a bug that is mainly valuable *after* another browser compromise is already a narrowed, multi-stage path, and that compounding friction matters more than the theoretical sandbox-escape impact.

Why not lower?

It is still a browser security-boundary issue in one of the most deployed client applications in the enterprise. If an attacker already has a renderer foothold, this kind of bug can turn a contained browser exploit into meaningful endpoint access, so it is not something to dismiss outright.

1. Enforce browser auto-update and relaunch — Make sure managed Chrome channels actually move off vulnerable builds and that users relaunch so the patched binary is loaded. For a LOW noisgate verdict there is no mitigation SLA; treat this as backlog hygiene and verify compliance on the next standard browser-maintenance cycle.
2. Prefer browser isolation for high-risk users — Use remote/browser isolation or hardened VDI for executives, admins, and click-prone populations that routinely touch untrusted media. For a LOW verdict there is no mitigation SLA, but this is a sensible standing control rather than a CVE-specific emergency move.
3. Block unmanaged and portable browsers — The real risk in large fleets is drift: unmanaged Chrome installs, stale local profiles, and portable copies that miss enterprise update policy. For a LOW verdict there is no mitigation SLA, so fold this into normal endpoint hygiene and software control.
4. Watch for browser exploit telemetry — Tune EDR and browser-protection telemetry for Chrome crash spikes, suspicious child processes, and abnormal access to browser data stores. There is no mitigation SLA for LOW, but telemetry gives you early warning if this bug starts appearing in chains.

Run this on the target endpoint or through your software-distribution/EDR script runner. Invoke it with python3 chrome_cve_2026_10981_check.py; it needs only standard user rights and prints VULNERABLE, PATCHED, or UNKNOWN based on the installed Google Chrome version.

#!/usr/bin/env python3
# Check local Google Chrome version against the fixed build for CVE-2026-10981
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import subprocess
import sys

FIXED = (149, 0, 7827, 53)


def parse_version(text):
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def run_cmd(cmd):
    try:
        out = subprocess.check_output(cmd, stderr=subprocess.STDOUT, text=True)
        return out.strip()
    except Exception:
        return None


def get_windows_version():
    reg_paths = [
        ["reg", "query", r"HKLM\SOFTWARE\Google\Chrome\BLBeacon", "/v", "version"],
        ["reg", "query", r"HKLM\SOFTWARE\WOW6432Node\Google\Chrome\BLBeacon", "/v", "version"],
        ["reg", "query", r"HKCU\SOFTWARE\Google\Chrome\BLBeacon", "/v", "version"],
    ]
    for cmd in reg_paths:
        out = run_cmd(cmd)
        if out:
            v = parse_version(out)
            if v:
                return v, out
    default_paths = [
        r"C:\Program Files\Google\Chrome\Application\chrome.exe",
        r"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe",
    ]
    for p in default_paths:
        if os.path.exists(p):
            ps = [
                "powershell",
                "-NoProfile",
                "-Command",
                f"(Get-Item '{p}').VersionInfo.ProductVersion"
            ]
            out = run_cmd(ps)
            if out:
                v = parse_version(out)
                if v:
                    return v, out
    return None, None


def get_macos_version():
    candidates = [
        "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome",
        os.path.expanduser("~/Applications/Google Chrome.app/Contents/MacOS/Google Chrome"),
    ]
    for c in candidates:
        if os.path.exists(c):
            out = run_cmd([c, "--version"])
            if out:
                v = parse_version(out)
                if v:
                    return v, out
    return None, None


def get_linux_version():
    candidates = [
        ["google-chrome", "--version"],
        ["google-chrome-stable", "--version"],
        ["/usr/bin/google-chrome", "--version"],
        ["/usr/bin/google-chrome-stable", "--version"],
    ]
    for cmd in candidates:
        out = run_cmd(cmd)
        if out:
            v = parse_version(out)
            if v:
                return v, out
    return None, None


def main():
    system = platform.system()
    if system == "Windows":
        version, raw = get_windows_version()
    elif system == "Darwin":
        version, raw = get_macos_version()
    elif system == "Linux":
        version, raw = get_linux_version()
    else:
        print(f"UNKNOWN: unsupported platform '{system}'")
        sys.exit(2)

    if not version:
        print("UNKNOWN: Google Chrome version not found")
        sys.exit(2)

    version_str = ".".join(str(x) for x in version)
    fixed_str = ".".join(str(x) for x in FIXED)

    if version < FIXED:
        print(f"VULNERABLE: installed Chrome {version_str} is older than fixed {fixed_str}")
        sys.exit(1)
    else:
        print(f"PATCHED: installed Chrome {version_str} is at or above fixed {fixed_str}")
        sys.exit(0)


if __name__ == "__main__":
    main()

Sources

1. Google Chrome Stable Channel Update for Desktop (Chrome 149)
2. Google Chrome Early Stable Update for Desktop
3. Chromium issue 513762354
4. Canadian Centre for Cyber Security advisory AV26-544
5. CISA Known Exploited Vulnerabilities Catalog
6. FIRST EPSS model documentation
7. StatCounter desktop browser market share worldwide