Heap buffer overflow in TabStrip in Google Chrome prior to 149

CVE-2026-10995 is a heap buffer overflow in Chrome's TabStrip UI component affecting Google Chrome versions earlier than 149.0.7827.53. The bug is triggered from a crafted HTML page, but the attacker also has to get the victim to perform *specific UI gestures* while interacting with the browser. That is materially different from the classic no-click renderer bug: this sits in a UI path, not a broadly reachable network service, and its preconditions narrow the real-world hit rate.

The supplied 8.8/HIGH baseline overstates operational risk for enterprise patch triage. Google's own June 2, 2026 stable release groups CVE-2026-10995 as Medium, and that tracks reality better: there is no KEV listing, EPSS is extremely low, no public exploit chain is visible, and the attack needs both page delivery and human choreography. Still, it is a memory corruption bug in the most widely deployed browser on most fleets, so this is not backlog trash.

Why this verdict

• Down from 8.8 because this is not a no-click browser bug — the victim must browse attacker content *and* perform specific UI gestures, which is more restrictive than ordinary UI:R web exploitation.
• Down again because the attacker position is still pre-compromise internet delivery, but the reachable population for the vulnerable code path is narrower than Chrome's raw install base; many users will see the page, few will reproduce the exact gesture chain.
• Down again because there is no exploitation signal — no KEV listing, very low EPSS (0.00032), and no public PoC or campaign reporting in the reviewed sources.
• Kept at MEDIUM instead of LOW because Chrome is everywhere and heap corruption bugs can still become valuable when paired with social engineering or a second-stage escape.

Why not higher?

A higher rating would fit a renderer bug with page-load-only reachability, a public exploit, or active exploitation. We do not have any of those here. The required UI choreography and likely exploit brittleness are real-world friction points that sharply reduce both attacker success rate and enterprise-wide urgency.

Why not lower?

This is still memory corruption in the dominant browser on enterprise endpoints, not a cosmetic UI issue. If the gesture chain is met, the bug plausibly enables meaningful browser-process compromise, so dismissing it as hygiene would be too optimistic. Chrome's prevalence keeps the population size large even when exploitability is constrained.

1. Enforce browser version compliance — Use MDM, EDR, or software inventory to flag any host running Chrome < 149.0.7827.53 and block drift from auto-update rings. Because this is MEDIUM, there is no mitigation SLA — go straight to the 365-day remediation window, but mature shops should close browser lag much sooner as normal endpoint hygiene.
2. Keep Safe Browsing and web filtering on — This bug still needs malicious content delivery, so URL filtering, DNS controls, SWG, and Chrome Safe Browsing reduce attacker access to the trigger page. For this verdict there is no mitigation SLA, so treat this as standing control hardening while you complete remediation inside the 365-day window.
3. Isolate high-risk browsing roles — Apply browser isolation or hardened browsing profiles for executives, admins, help desk, finance, and users who live in webmail or unknown links. That does not eliminate the bug, but it materially lowers the chance that precise gesture-based exploitation succeeds before remediation.
4. Watch for Chrome crash clusters — Pull browser crash telemetry and EDR fault events for repeated chrome crashes after 2026-06-04, especially around phishing campaigns or uncommon domains. Repeated tab/UI crashes can be your only early hint that someone is trying to exercise this path.

Run this on the target endpoint or through your fleet-management agent. Invoke it with python3 chrome_cve_2026_10995_check.py on macOS/Linux or py chrome_cve_2026_10995_check.py on Windows; no admin rights are required if the script can read the Chrome executable version metadata from standard install paths.

#!/usr/bin/env python3
# CVE-2026-10995 Google Chrome version check
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import platform
import re
import subprocess
import sys
from shutil import which

TARGET = (149, 0, 7827, 53)


def parse_version(text):
    if not text:
        return None
    m = re.search(r'(\d+)\.(\d+)\.(\d+)\.(\d+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def cmp_ver(a, b):
    return (a > b) - (a < b)


def get_version_from_command(cmd):
    try:
        out = subprocess.check_output(cmd, stderr=subprocess.STDOUT, text=True, timeout=10)
        return parse_version(out.strip())
    except Exception:
        return None


def get_linux_version():
    candidates = [
        ["google-chrome", "--version"],
        ["google-chrome-stable", "--version"],
        ["/opt/google/chrome/chrome", "--version"],
        ["chromium", "--version"],
        ["chromium-browser", "--version"],
    ]
    for cmd in candidates:
        exe = cmd[0]
        if exe.startswith("/") or which(exe):
            v = get_version_from_command(cmd)
            if v:
                return v, " ".join(cmd)
    return None, None


def get_macos_version():
    candidates = [
        "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome",
        os.path.expanduser("~/Applications/Google Chrome.app/Contents/MacOS/Google Chrome"),
    ]
    for app in candidates:
        if os.path.exists(app):
            v = get_version_from_command([app, "--version"])
            if v:
                return v, app
    return None, None


def get_windows_version():
    try:
        import winreg
    except Exception:
        winreg = None

    # Try registry first
    if winreg is not None:
        reg_paths = [
            (winreg.HKEY_CURRENT_USER, r"Software\Google\Chrome\BLBeacon", "version"),
            (winreg.HKEY_LOCAL_MACHINE, r"Software\Google\Chrome\BLBeacon", "version"),
            (winreg.HKEY_LOCAL_MACHINE, r"Software\WOW6432Node\Google\Chrome\BLBeacon", "version"),
        ]
        for hive, path, name in reg_paths:
            try:
                key = winreg.OpenKey(hive, path)
                value, _ = winreg.QueryValueEx(key, name)
                v = parse_version(str(value))
                if v:
                    return v, f"registry:{path}"
            except Exception:
                pass

    # Fallback to executable version via PowerShell
    candidates = [
        os.path.join(os.environ.get("ProgramFiles", r"C:\Program Files"), r"Google\Chrome\Application\chrome.exe"),
        os.path.join(os.environ.get("ProgramFiles(x86)", r"C:\Program Files (x86)"), r"Google\Chrome\Application\chrome.exe"),
        os.path.join(os.environ.get("LOCALAPPDATA", ""), r"Google\Chrome\Application\chrome.exe"),
    ]
    for exe in candidates:
        if exe and os.path.exists(exe):
            ps = [
                "powershell",
                "-NoProfile",
                "-Command",
                f"(Get-Item '{exe}').VersionInfo.ProductVersion"
            ]
            v = get_version_from_command(ps)
            if v:
                return v, exe
    return None, None


def main():
    system = platform.system().lower()

    if system == "windows":
        version, source = get_windows_version()
    elif system == "darwin":
        version, source = get_macos_version()
    else:
        version, source = get_linux_version()

    if not version:
        print("UNKNOWN - Google Chrome version not found")
        sys.exit(2)

    if cmp_ver(version, TARGET) < 0:
        print(f"VULNERABLE - found {'.'.join(map(str, version))} via {source}; need >= {'.'.join(map(str, TARGET))}")
        sys.exit(1)
    else:
        print(f"PATCHED - found {'.'.join(map(str, version))} via {source}; fixed version is >= {'.'.join(map(str, TARGET))}")
        sys.exit(0)


if __name__ == "__main__":
    main()

Sources

1. Google Chrome Releases - Stable Channel Update for Desktop (Chrome 149)
2. OpenCVE record for CVE-2026-10995
3. Chromium issue 505371980
4. CISA Known Exploited Vulnerabilities Catalog
5. FIRST EPSS overview
6. FIRST EPSS API documentation
7. StatCounter browser market share worldwide