What is the CVSS score of CVE-2026-10012?

CVE-2026-10012 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-10012?

A vulnerability in Google Chrome's graphics library (CVE-2026-10012) could allow attackers to break out of the browser sandbox and potentially access the underlying system, creating risk of data…. A patch is available.

How to fix or mitigate CVE-2026-10012?

Within 24 hours: Issue security notification to Chrome users and IT administrators regarding CVE-2026-10012. Within 7 days: Distribute and deploy Chrome version 148.0.7778.216 or later through autoupdate or endpoint management systems. Within 30 days: Verify patch deployment across the organization and monitor system logs for any exploitation attempts.

Google Chrome CVE-2026-10012

EUVD-2026-33154 HIGH

Use After Free (CWE-416)

2026-05-28 Chrome

GHSA-rwgc-9q6h-cxwg

Denial Of Service Google Use After Free Memory Corruption

8.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.2 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 17:30 vuln.today

CVSS changed

May 29, 2026 - 15:22 NVD

8.3 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 8.3

DescriptionNVD

Use after free in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome's Skia graphics library prior to version 148.0.7778.216 allows remote attackers who have already compromised the renderer process to break out of the browser sandbox via a crafted HTML page. The flaw is a use-after-free memory corruption issue rated High by Chromium, with a patch shipped through the Stable channel and no public exploit identified at time of analysis. EPSS probability is very low (0.03%) and the CVE is not on the CISA KEV list, indicating no observed in-the-wild exploitation despite the serious technical impact.

Technical ContextAI

Skia is the 2D graphics rendering library used by Chrome (and Chromium-derived browsers) for drawing HTML canvas, fonts, shapes, and compositor output. The root cause is CWE-416 (Use After Free), where memory referenced by a Skia object is freed but still accessed, allowing an attacker who controls heap layout to coerce the freed allocation into holding attacker-influenced data. Because Skia runs in the renderer process but its bugs can be chained with IPC or GPU process interactions, a UAF here is leveraged as a sandbox escape primitive: per the CPE (cpe:2.3:a:google:chrome:*) the issue affects Google Chrome desktop builds before 148.0.7778.216, and chromium-derived browsers (Edge, Brave, Opera, Vivaldi) typically inherit the same code path until they rebase.

RemediationAI

Vendor-released patch: update Google Chrome to 148.0.7778.216 or later via the Stable channel as documented at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html, and verify via chrome://settings/help that the browser has restarted to apply the fix. For managed fleets, push the update through Chrome Browser Cloud Management or your endpoint management tool and force a relaunch, since the patch only activates after restart. Users of Chromium-based browsers (Edge, Brave, Opera, Vivaldi) should apply their respective vendor updates once the Skia fix is merged downstream. No workarounds are documented; as compensating controls until patches roll out, consider disabling GPU acceleration (chrome://flags) which can reduce some Skia attack surface at the cost of rendering performance, restrict browsing to trusted sites via enterprise policy URLBlocklist, and ensure site isolation (already default) remains enabled to limit the value of a renderer compromise that would be needed to reach this bug.