What is the CVSS score of CVE-2026-10003?

CVE-2026-10003 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-10003?

A remote code execution vulnerability affects all Chrome users in the organization, allowing attackers to execute arbitrary code on unpatched systems through crafted web pages.. A patch is available.

How to fix or mitigate CVE-2026-10003?

24 hours: Identify Chrome deployments and publish urgent patching notification to all users; 7 days: Deploy Chrome 148.0.7778.216 or later across all endpoints via auto-update policies and/or MDM; 30 days: Verify complete deployment and document patch compliance in vulnerability tracking system.

Google Chrome CVE-2026-10003

EUVD-2026-33145 HIGH

Use After Free (CWE-416)

2026-05-28 Chrome

GHSA-5f84-9cxm-x8fc

RCE Denial Of Service Google Use After Free Memory Corruption

7.5

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 12:22 vuln.today

CVSS changed

May 29, 2026 - 12:22 NVD

7.5 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 7.5

DescriptionCVE.org

Use after free in Views in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome versions prior to 148.0.7778.216 stems from a use-after-free condition in the Views UI component, allowing a remote attacker to execute arbitrary code if they can convince a user to perform specific UI gestures on a crafted HTML page. Chromium rates this as High severity and a vendor patch is available, but no public exploit has been identified at time of analysis.

Technical ContextAI

The vulnerability resides in Chrome's Views framework, the cross-platform UI toolkit used to render browser chrome elements (windows, menus, dialogs, buttons) that exists outside of the web content renderer sandbox. The root cause is CWE-416 (Use After Free), a memory safety flaw where the program continues to reference memory after it has been deallocated, enabling an attacker who controls subsequent heap allocations to manipulate freed object state. Because Views runs in the browser process rather than a sandboxed renderer, successful exploitation can yield code execution at a higher privilege level than typical renderer-bound bugs. The CPE cpe:2.3:a:google:chrome covers all Chrome distributions prior to the fixed build 148.0.7778.216.

RemediationAI

Vendor-released patch: update Google Chrome to 148.0.7778.216 or later on the Stable channel; the fix is delivered through Chrome's automatic update mechanism and a browser restart is required for it to take effect, so confirm restart compliance in managed fleets. Reference the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html and the upstream tracker at https://issues.chromium.org/issues/513609324, and watch for corresponding updates from Chromium-based browser vendors (Edge, Brave, Opera) which typically follow within days. If immediate patching is not feasible, compensating controls include restricting browsing to trusted sites via enterprise policy (URLBlocklist/URLAllowlist), enabling Site Isolation if not already on by default, and user awareness training to avoid interacting with unfamiliar prompts or UI elements on untrusted pages - note that these mitigations reduce but do not eliminate exposure since the trigger is a routine HTML page combined with user UI interaction.