Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.3
CVE-2026-10949: Google Chrome: Malicious HTML can escape security sandbox
CVE-2026-10949 · published 5 months ago
Summary
A security flaw in Google Chrome allows a hacker who has already compromised a user's browser to break out of the browser's security sandbox. This could allow the hacker to access sensitive information or take control of the user's computer. To fix this issue, update Google Chrome to version 149.0.7827.53 or later.
What to do
- Update debian chromium to version 149.0.7827.53-1~deb12u1.
- Update debian chromium to version 149.0.7827.53-1~deb13u1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:11 | debian | chromium | All versions |
| Debian:12 | debian | chromium |
< 149.0.7827.53-1~deb12u1 Fix: upgrade to 149.0.7827.53-1~deb12u1
|
| Debian:13 | debian | chromium |
< 149.0.7827.53-1~deb13u1 Fix: upgrade to 149.0.7827.53-1~deb13u1
|
| Debian:14 | debian | chromium | All versions |
Original advisory text
Heap buffer overflow in Video in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML p...
Heap buffer overflow in Video in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-122Heap-based Buffer Overflow
Timeline
Published4 Jun 2026
Updated31 Oct 2026
First seen5 Jun 2026
Track software like this
Free during beta