What is the CVSS score of CVE-2026-10005?

CVE-2026-10005 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-10005?

Google Chrome on macOS prior to version 148.0.7778.216 contains a use-after-free vulnerability enabling remote code execution when users visit attacker-controlled websites.. A patch is available.

How to fix or mitigate CVE-2026-10005?

Within 24 hours: Verify the current Chrome version distribution on all macOS endpoints using your MDM or asset management platform. Within 7 days: Deploy Chrome 148.0.7778.216 or later to 80% of affected devices using your standard software update process. Within 30 days: Achieve full patching coverage (95%+) and document completion in your vulnerability management system.

Google Chrome CVE-2026-10005

EUVD-2026-33147 HIGH

Use After Free (CWE-416)

2026-05-28 Chrome

GHSA-p5p5-xjxr-p523

RCE Denial Of Service Google Use After Free Memory Corruption

7.5

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 12:22 vuln.today

CVSS changed

May 29, 2026 - 12:22 NVD

7.5 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 7.5

DescriptionCVE.org

Use after free in WebAppInstalls in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome on macOS prior to 148.0.7778.216 stems from a use-after-free condition in the WebAppInstalls component, enabling a remote attacker to execute arbitrary code in the renderer context when a victim is lured to a malicious page and performs specific UI gestures. Chromium rates the severity as High, and while no public exploit identified at time of analysis, the bug class (UAF) is historically a favored target for Chrome exploit chains. The high attack complexity and required user interaction lower the practical exploitability compared to one-click bugs.

Technical ContextAI

The flaw resides in WebAppInstalls, the Chromium subsystem that handles Progressive Web App (PWA) installation prompts and lifecycle on the desktop. The root cause is CWE-416 (Use After Free): an object reference is retained and dereferenced after its backing memory has been freed, typically due to incorrect lifetime management during asynchronous UI events. On macOS this corresponds to cpe:2.3:a:google:chrome built against the platform's renderer/browser process model, where successful exploitation usually yields code execution inside the sandboxed renderer and would normally need to be paired with a sandbox escape to achieve full system compromise.

RemediationAI

Vendor-released patch: 148.0.7778.216 - upgrade Chrome on macOS to 148.0.7778.216 or later via the Stable channel auto-updater or managed deployment (MDM/Jamf/Intune) and force a browser restart so the new binary loads. Verify via chrome://settings/help and consult the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html and the Chromium issue tracker https://issues.chromium.org/issues/513750089. If patching is delayed, compensating controls include disabling Progressive Web App installation via the WebAppInstallForceList / DefaultWebAppInstallationEnabled enterprise policies to reduce exposure of the WebAppInstalls code path (trade-off: breaks PWA install workflows for users), and restricting browsing to trusted sites via SafeSites/URL allowlists; these mitigate but do not eliminate the UAF since the vulnerable code may still be reachable.