What is the CVSS score of CVE-2026-10006?

CVE-2026-10006 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-10006?

Google Chrome versions prior to 148.0.7778.216 contain a remote code execution vulnerability in the WebAudio renderer that can be triggered by visiting a malicious webpage, allowing attackers to…. A patch is available.

How to fix or mitigate CVE-2026-10006?

24 hours: Verify Chrome deployment scope and auto-update configuration across all managed endpoints. 7 days: Deploy Google Chrome version 148.0.7778.216 or later to all endpoints; configure forced updates if auto-update is disabled. 30 days: Audit Chrome version compliance across all systems and enable mandatory update policies to prevent version drift.

Google Chrome CVE-2026-10006

EUVD-2026-33148 HIGH

Race Condition (CWE-362)

2026-05-28 Chrome

GHSA-c58x-vh32-87m5

RCE Google Race Condition

7.5

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 13:22 vuln.today

CVSS changed

May 29, 2026 - 13:22 NVD

7.5 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 7.5

DescriptionCVE.org

Race in WebAudio in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome versions prior to 148.0.7778.216 allows remote attackers to execute arbitrary code within the renderer sandbox by enticing a victim to visit a crafted HTML page that triggers a race condition in the WebAudio component. Google rates the underlying Chromium issue as High severity, and while no public exploit identified at time of analysis, the bug is browser-resident and reachable from any web origin, making it a meaningful drive-by risk once details surface. EPSS data was not provided, and the issue is not currently listed in CISA KEV.

Technical ContextAI

The flaw resides in WebAudio, the Blink/Chromium subsystem that implements the W3C Web Audio API for synthesizing and processing audio graphs inside the renderer process. The root cause is CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization, i.e. a race condition) - WebAudio uses a real-time audio thread that operates on shared AudioNode and buffer state alongside the main thread, and insufficient synchronization on those shared structures can lead to use-after-free or type confusion that an attacker grooms into arbitrary code execution. Per the CPE (cpe:2.3:a:google:chrome:*), all Chrome desktop builds before 148.0.7778.216 ship the vulnerable WebAudio code; because exploitation occurs inside the renderer, successful exploitation yields code execution constrained by the Chromium sandbox (Scope:Unchanged in the CVSS vector confirms no sandbox escape).

RemediationAI

Vendor-released patch: Google Chrome 148.0.7778.216 or later on the Stable desktop channel - update via Chrome's built-in updater (chrome://settings/help) or enterprise tooling (Chrome Browser Cloud Management, Google Update group policies) and force a relaunch so the new renderer binary is loaded, since active tabs continue running the vulnerable code until restart. Administrators of Chromium-derived browsers should track their vendor's release notes (Microsoft Edge, Brave, Opera, Electron) and roll those updates once they ship the merged WebAudio fix; reference the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html and the Chromium issue https://issues.chromium.org/issues/513750691. If patching must be deferred, compensating controls include disabling the WebAudio API via enterprise policy or site-isolation tightening, or blocking untrusted browsing through proxy/category filtering - note that disabling WebAudio breaks legitimate audio web apps (video conferencing, browser games, music tools) and site-isolation changes can increase per-tab memory overhead.