What is the CVSS score of CVE-2026-10014?

CVE-2026-10014 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-10014?

Google Chrome for Android users face a high-severity sandbox escape vulnerability (CVE-2026-10014) that enables attackers with renderer-level access to execute arbitrary code on affected devices.. A patch is available.

How to fix or mitigate CVE-2026-10014?

Within 24 hours: Audit current Chrome versions deployed on Android devices across the organization using mobile device management (MDM) tools. Within 7 days: Deploy Chrome 148.0.7778.216 or later to all affected Android devices via automatic update mechanisms or MDM push. Within 30 days: Confirm minimum 95% update compliance and establish a quarterly Chrome update cadence.

Google Chrome CVE-2026-10014

EUVD-2026-33156 HIGH

Use After Free (CWE-416)

2026-05-28 Chrome

GHSA-gm2w-gw5x-592f

Google Use After Free Denial Of Service Memory Corruption Chrome

8.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.0 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 15:22 vuln.today

CVSS changed

May 29, 2026 - 15:22 NVD

8.3 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 8.3

DescriptionCVE.org

Use after free in WebMIDI in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome on Android prior to 148.0.7778.216 allows a remote attacker who has already compromised the renderer process to break out of the sandbox via a crafted HTML page that triggers a use-after-free in the WebMIDI component. Chromium rates the severity High, and a vendor patch is available; no public exploit is identified at time of analysis and EPSS is very low at 0.03%.

Technical ContextAI

WebMIDI is the Chromium implementation of the W3C Web MIDI API, which lets web pages enumerate and send/receive messages from MIDI hardware via the browser process and the GPU/utility processes. The bug is CWE-416 (Use After Free): an object in the WebMIDI subsystem is freed while a dangling reference is still reachable, and subsequent reuse of that memory lets attacker-controlled data be treated as a valid object. Because WebMIDI message handling traverses the renderer-to-browser IPC boundary, corrupting state on the privileged side is what makes a sandbox escape (CVSS S:C, scope change) possible from an already-compromised renderer. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* and the description explicitly scopes impact to the Android build of Chrome.

RemediationAI

Vendor-released patch: Chrome for Android 148.0.7778.216 - update via Google Play or the Chrome Stable channel as described in the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html. In managed Android fleets, push the update through Managed Google Play / MDM and verify chrome://version after rollout. If patching must be deferred, the most targeted compensating control is to block the Web MIDI API via enterprise policy (DefaultWebMidiSysexSetting / WebMidiAllowedForUrls denylist) or by disabling MIDI at the OS/site-permission level, which prevents the vulnerable code path from being reached at the cost of breaking any legitimate web MIDI tooling; broader fallbacks such as restricting browsing to trusted sites or enforcing Safe Browsing Enhanced Protection reduce exposure to crafted-page delivery but do not address the underlying UAF.