What is the CVSS score of CVE-2026-10007?

CVE-2026-10007 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-10007?

The organization's Chrome user base faces significant risk from CVE-2026-10007, a remote code execution vulnerability affecting unpatched versions that can be exploited through web-based…. A patch is available.

How to fix or mitigate CVE-2026-10007?

Within 24 hours: Issue security alert to all Chrome users recommending immediate update and advising caution with untrusted websites; prepare deployment package for Chrome version 148.0.7778.216 or later. Within 7 days: Deploy Chrome version 148.0.7778.216 or later to all managed devices using your software distribution system and monitor deployment completion. Within 30 days: Audit all systems to verify 100% patch compliance and document remediation for any devices that remain unpatched.

Google Chrome CVE-2026-10007

EUVD-2026-33149 HIGH

Use After Free (CWE-416)

2026-05-28 Chrome

GHSA-gjc7-326g-45pj

Use After Free RCE Memory Corruption Google Denial Of Service Chrome

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 12:22 vuln.today

CVSS changed

May 29, 2026 - 12:22 NVD

8.8 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in SVG in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome versions prior to 148.0.7778.216 stems from a use-after-free flaw in the SVG rendering component, allowing remote attackers to execute arbitrary code within the renderer sandbox by luring a user to a crafted HTML page. Rated High severity by the Chromium project with a CVSS score of 8.8, the issue requires user interaction (visiting a malicious page) but no authentication. No public exploit identified at time of analysis, and the vulnerability is not currently listed in CISA KEV.

Technical ContextAI

The vulnerability is a CWE-416 Use-After-Free condition in Google Chrome's SVG (Scalable Vector Graphics) handling code, which is part of the Blink rendering engine. Use-after-free flaws occur when memory is freed but a dangling pointer continues to reference it, allowing an attacker who controls subsequent heap allocations to manipulate object state and ultimately hijack control flow. SVG parsing and DOM manipulation are historically rich sources of UAF bugs in browsers due to the complex object lifecycle interactions between SVG elements, CSS, animations, and JavaScript callbacks. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covering all Chrome desktop builds prior to 148.0.7778.216.

RemediationAI

Vendor-released patch: Google Chrome 148.0.7778.216 - upgrade all desktop Chrome installations to this version or later via the Stable channel update referenced at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html and verify via chrome://settings/help. Operators of Chromium-derived browsers (Edge, Brave, Opera, Electron applications) should track and apply their respective vendor updates that incorporate the upstream Blink fix tracked at https://issues.chromium.org/issues/513754619. As a compensating control until patches are deployed, enterprise admins can enforce Site Isolation (already default), restrict browsing to allowlisted sites via the URLAllowlist/URLBlocklist enterprise policies (trade-off: significant usability impact and user friction), or disable SVG rendering via content settings or extensions (trade-off: breaks legitimate sites that use SVG icons and graphics, which is most of the modern web). Standard endpoint protections such as exploit-mitigation EDR rules and ad/script blockers reduce drive-by exposure but do not address the underlying flaw.