What is the CVSS score of CVE-2026-10000?

CVE-2026-10000 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-10000?

Windows-based Chrome deployments are vulnerable to system compromise through a sandbox escape (CVE-2026-10000, CVSS 8.3) affecting versions prior to 148.0.7778.216.. A patch is available.

How to fix or mitigate CVE-2026-10000?

Within 24 hours: audit Chrome version distribution on Windows endpoints and establish patch deployment timeline. Within 7 days: validate Chrome 148.0.7778.216 in test environment and begin staged rollout to production. Within 30 days: complete deployment of Chrome 148.0.7778.216 across all Windows systems and confirm deployment completion.

Google Chrome CVE-2026-10000

EUVD-2026-33142 HIGH

Use After Free (CWE-416)

2026-05-28 Chrome

GHSA-94p9-r92m-453h

Denial Of Service Google Use After Free Memory Corruption Microsoft

8.3

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.2 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 17:30 vuln.today

CVSS changed

May 29, 2026 - 15:22 NVD

8.3 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 8.3

DescriptionCVE.org

Use after free in Passwords in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome on Windows prior to 148.0.7778.216 allows a remote attacker who has already compromised the renderer process to break out via a use-after-free in the Passwords component, delivered through a crafted HTML page. Exploitation requires user interaction and high attack complexity, and no public exploit identified at time of analysis, though Google rates the underlying Chromium severity as High and a vendor patch is available.

Technical ContextAI

The flaw resides in Chrome's Passwords subsystem and is a CWE-416 Use-After-Free, where memory is referenced after being freed, enabling an attacker who controls renderer-side execution to corrupt heap state and pivot across the sandbox boundary. The affected component (cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) is the Chromium-based browser on Windows; sandbox escapes in Chrome typically require chaining a renderer compromise (separate bug) with a UAF in a higher-privileged browser-process feature like the password manager IPC handlers, leveraging the CVSS Scope:Changed property which indicates the impact extends beyond the originally vulnerable component.

RemediationAI

Vendor-released patch: update Chrome on Windows to 148.0.7778.216 or later via Chrome's auto-update or by relaunching the browser (Help > About Google Chrome); enterprise admins can deploy via the Chrome Enterprise MSI or Group Policy as described in Google's advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html. Users of Chromium-based browsers (Edge, Brave, Opera) should apply their vendor's corresponding update once published. As a compensating control until patched, restrict browsing to trusted sites and enable Enhanced Safe Browsing, and consider disabling the built-in password manager via the PasswordManagerEnabled=false policy (side effect: users lose autofill and must use an external password manager); blocking untrusted HTML rendering at proxy level is impractical for general browsing.