What is Prince William and Harry's surname?

It's complicated.

The Queen has stipulated that all her male descendants who do not bear the titular dignity of Prince shall use Mountbatten-Windsor as their surname.

Willam and Harry, though, DO "bear the titular dignity of Prince".

For these cases, children generally use "Prince X of Y" where X is their given name and Y is their father's territorial designation. For William and Harry, their father is Prince Charles, who is the Prince of Wales, so they were "Prince William of Wales" and "Prince Harry of Wales".

This is normally dropped when such children reach adulthood and simply use their title. You need a last name when you might get confused with someone else. The likelihood of, say, Prince William, Duke of Cambridge getting confused with some other Prince William, Duke of Cambridge is pretty small.

However: William and Harry were both in the military, and not having a surname in the military is a little awkward. Both of them used "Wales" as their surname in a military context. William (as Duke of Cambridge) now has his own territorial designation; I'm not sure if he's been updated officially to "William Cambridge" in the military or not.