What is the CVSS score of CVE-2026-10004?

CVE-2026-10004 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-10004?

Yes, a patch is available for CVE-2026-10004. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-10004

EUVD-2026-33146 MEDIUM

Improper Input Validation (CWE-20)

2026-05-28 Chrome

GHSA-p337-8mm9-6p6x

Information Disclosure Google

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

SUSE

5.4 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L

Red Hat

5.4 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 17:57 vuln.today

CVSS changed

May 29, 2026 - 17:52 NVD

6.5 (MEDIUM)

CVE Published

May 28, 2026 - 22:25 nvd

MEDIUM 6.5

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

DescriptionNVD

Insufficient validation of untrusted input in Passwords in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

UI spoofing in Google Chrome's Passwords component (all versions prior to 148.0.7778.216) allows a remote, unauthenticated attacker to manipulate browser-native password UI elements by delivering a crafted HTML page to a victim. The flaw arises from insufficient input validation (CWE-20) in the Passwords subsystem, enabling attacker-controlled content to render deceptive credential prompts that are visually indistinguishable from legitimate Chrome dialogs. No public exploit has been identified at time of analysis and the CVE is absent from CISA KEV, though the zero-privilege, network-accessible attack surface and High Chromium severity designation make patching a clear priority.

Technical ContextAI

The vulnerability resides in the Passwords subsystem of Google Chrome (CPE: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*), which governs credential autofill overlays, password save/update prompts, and storage interactions within the browser UI. CWE-20 (Improper Input Validation) indicates the component fails to adequately sanitize attacker-supplied HTML content before using it to influence rendering of trusted browser-native UI surfaces. This class of flaw allows malicious pages to inject or distort elements such as autofill suggestion dropdowns or credential dialogs - surfaces the user expects to be browser-controlled and therefore trusted - turning them into attacker-controlled spoofs. The vulnerability is scoped to the browser process itself (S:U, no scope change), meaning it cannot directly escape to the OS or cross browser origins via this bug alone.

RemediationAI

The primary fix is to update Google Chrome to version 148.0.7778.216 or later, as released in the May 2026 stable channel update at http://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html. Chrome auto-updates by default, but enterprise administrators should verify deployment via fleet management tooling or enforce update timelines through Group Policy Objects (Windows) or Managed Preferences (macOS). As a compensating control where immediate upgrade is not possible, disabling Chrome's built-in password manager (Settings > Autofill and Passwords > Google Password Manager) removes the vulnerable component from the attack path, at the cost of losing integrated credential autofill functionality. Organizations should not rely on this workaround long-term given the default-on nature of the password manager in standard deployments.