Google Chrome CVE-2026-10969

The attacker must already have compromised the Chrome renderer process (the CVE description states this explicitly), making this a sandbox-escape link in a multi-bug chain rather than a standalone vulnerability - a separate renderer RCE is a hard prerequisite. The victim must then load and interact with a crafted HTML page (CVSS UI:R), and exploitation is rated AC:H, indicating non-trivial conditions such as specific timing, memory layout, or extension API state. The vulnerable code path is in the Extensions component, so deployments where Chrome's extension subsystem is fully disabled by enterprise policy face reduced (but not necessarily eliminated) exposure. Affected versions are Chrome below 149.0.7827.53 on Stable channel desktop builds.

The CVSS 7.5 score with vector AV:N/AC:H/PR:N/UI:R reflects a network-reachable issue but with high attack complexity and required user interaction, which is consistent with a second-stage bug that must be chained from a prior renderer RCE and triggered via a crafted page the victim visits. CISA's SSVC framework concurs that this is not a standalone priority: exploitation status is 'none', the bug is not automatable, but technical impact is 'total' - meaning if it is chained it fully breaks the sandbox. There is no CISA KEV listing, no EPSS data provided, and no public exploit identified at time of analysis, so real-world risk today is moderate and primarily relevant to defenders concerned with sophisticated exploit chains (e.g., targeted attacks, n-day chaining) rather than mass exploitation. Note the apparent tension worth flagging: PR:N suggests no privileges, yet the description requires a pre-compromised renderer - Chromium's convention treats the renderer compromise as part of the attacker's setup rather than a CVSS prerequisite, so the vector is internally consistent with Chrome's threat model but can mislead readers who do not know this.

An attacker first achieves arbitrary code execution inside the Chrome renderer process via a separate renderer-RCE bug (a common scenario in modern browser exploit chains), then serves the victim a crafted HTML page that, when interacted with, invokes the vulnerable Extensions code path with malformed input. The Extensions component mishandles that input and the attacker uses the gap to escape the renderer sandbox and execute code with browser-process privileges, giving access to cookies, stored credentials, and the local file system. No public exploit has been identified at time of analysis.