CVE-2026-10963

Google · Chrome

An integer overflow vulnerability in the V8 JavaScript engine of Google Chrome could allow an attacker to execute arbitrary code.

Executive summary

An integer overflow vulnerability in the Google Chrome V8 engine presents a high-severity risk that could be leveraged for remote code execution.

Vulnerability

This vulnerability is an integer overflow in the V8 engine. It can be exploited by an unauthenticated attacker via a malicious website to corrupt memory and gain unauthorized control over the browser process.

Business impact

The CVSS score of 8.8 indicates a high risk to business operations. Successful exploitation could lead to the exfiltration of sensitive data, unauthorized access to user accounts, and potential pivot points for deeper network intrusion.

Remediation

Immediate Action: Update Google Chrome to version 149 or later across all enterprise endpoints.

Proactive Monitoring: Monitor for anomalies in browser memory usage and unauthorized outbound connections originating from web processes.

Compensating Controls: Utilize browser security configurations and group policies to disable unnecessary features that may increase the attack surface.

Exploitation status

Public Exploit Available: false

Analyst recommendation

Security teams should treat this vulnerability with high urgency. Patching is the only effective way to mitigate this risk, and deployment should be expedited to protect organizational assets from potential exploitation.