What is the CVSS score of CVE-2026-10001?

CVE-2026-10001 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-10001?

Google Chrome's sandbox protection is a fundamental security boundary that prevents compromised web pages from damaging the entire system; this vulnerability allows attackers to bypass that…. A patch is available.

How to fix or mitigate CVE-2026-10001?

Within 24 hours: Document current Chrome versions in use across the organization and identify vulnerable instances. Within 7 days: Deploy Chrome update to version 148.0.7778.216 or later via established patch management processes, prioritizing systems handling sensitive data or used by high-risk roles. Within 30 days: Verify 100% patch compliance and monitor endpoints for indicators of compromise or suspicious renderer process activity.

Google Chrome CVE-2026-10001

EUVD-2026-33143 HIGH

Use After Free (CWE-416)

2026-05-28 Chrome

GHSA-v9fw-r7h8-r3mr

Google Use After Free Denial Of Service Memory Corruption Red Hat Suse Chrome

8.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.7 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 15:22 vuln.today

CVSS changed

May 29, 2026 - 15:22 NVD

8.3 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 8.3

DescriptionCVE.org

Use after free in PerformanceManager in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome versions prior to 148.0.7778.216 allows a remote attacker who has already compromised the renderer process to break out of the browser sandbox via a use-after-free in the PerformanceManager component triggered by a crafted HTML page. Exploitation requires user interaction (visiting a malicious page) and a pre-existing renderer compromise, and while no public exploit has been identified at time of analysis, EPSS rates exploitation probability as low (0.03%, 11th percentile). The flaw is rated High severity by Chromium and carries a CVSS 3.1 score of 8.3 due to the scope-changing nature of a sandbox escape.

Technical ContextAI

The vulnerability resides in Chrome's PerformanceManager, a browser-process component that tracks resource usage and lifecycle state of renderer processes, frames, and workers to inform tab discarding, freezing, and prioritization decisions. CWE-416 (Use After Free) indicates that PerformanceManager retains or dereferences a pointer to an object that has already been freed, enabling memory corruption when an attacker manipulates renderer-side signals that drive object lifetimes in the browser process. Because PerformanceManager runs in the privileged browser process, a successful UAF here lets a compromised renderer escape the sandbox boundary that normally isolates web content from the host operating system. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* with fixes in 148.0.7778.216 on the Stable channel.

RemediationAI

Vendor-released patch: Google Chrome 148.0.7778.216 on the Stable channel - upgrade immediately via the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html and confirm enterprise fleets have restarted Chrome to load the new binary, since the update only takes effect after relaunch. Administrators of managed deployments should push the update via Google Update / Chrome Browser Cloud Management and audit downstream Chromium-based products (Edge, Brave, Opera, Electron apps) for corresponding releases once they ship. As a temporary compensating control where patching is delayed, enforce Site Isolation and strict site-per-process (already default but verify policy SitePerProcess=Enabled), restrict browsing to trusted sites via URL allowlists (URLAllowlist/URLBlocklist), and consider enabling enterprise policies that block untrusted extensions and disable JIT for less-trusted sites via JavaScriptJitAllowedForSites - trade-offs include broken intranet apps from strict allowlisting and measurable JavaScript performance regressions from JIT-off. Do not rely on disabling PerformanceManager itself, as it is not user-configurable.