What is the CVSS score of CVE-2026-10015?

CVE-2026-10015 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-10015?

Google Chrome versions prior to 148.0.7778.216 contain a critical integer overflow in the WTF component enabling remote code execution when users visit malicious webpages; no public exploit…. A patch is available.

How to fix or mitigate CVE-2026-10015?

Within 24 hours: Audit all Chrome deployments and identify systems running versions prior to 148.0.7778.216; communicate patch urgency to deployment teams. Within 7 days: Test Chrome version 148.0.7778.216 in controlled environments, verify business-critical extension compatibility, and prepare rollout procedures. Within 30 days: Deploy Chrome 148.0.7778.216 across all organizational endpoints and validate successful updates via inventory systems.

Google Chrome CVE-2026-10015

EUVD-2026-33157 HIGH

External Control of Assumed-Immutable Web Parameter (CWE-472)

2026-05-28 Chrome

GHSA-gh93-jmvr-g4f3

Google RCE Chrome

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 12:24 vuln.today

CVSS changed

May 29, 2026 - 12:22 NVD

8.8 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 8.8

DescriptionCVE.org

Integer overflow in WTF in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandboxed arbitrary code execution in Google Chrome versions prior to 148.0.7778.216 stems from an integer overflow in the WTF (Web Template Framework) component, exploitable when a victim visits a crafted HTML page. The flaw carries a CVSS 8.8 (High) rating and Chromium-assigned High severity, requires user interaction (UI:R) to load the malicious page, and no public exploit identified at time of analysis. While code execution is constrained to the renderer sandbox, this remains a strong primitive for chaining with sandbox escapes in real-world exploit kits.

Technical ContextAI

The vulnerability resides in WTF (Web Template Framework), a foundational C++ utility library inside Blink/Chromium that provides core data structures, string handling, and numeric primitives used throughout the renderer process. CWE-472 (External Control of Assumed-Immutable Web Parameter) is the assigned weakness class, though the description specifically points to an integer overflow - a numeric truncation or wraparound condition where arithmetic on attacker-influenced sizes/indices produces an undersized allocation or out-of-bounds access, frequently leading to memory corruption and code execution in the renderer. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* across versions below 148.0.7778.216 on desktop platforms, with the fix shipped via the Chrome Stable channel update referenced in the Chrome Releases blog.

RemediationAI

Vendor-released patch: upgrade Google Chrome to 148.0.7778.216 or later on all desktop platforms (Windows, macOS, Linux) per the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html; most installs will receive this automatically via Chrome's update mechanism but should be force-checked via chrome://settings/help and verified by inventory. For Chromium-based browsers, apply the corresponding vendor build that incorporates the upstream WTF fix once published. Where immediate patching is not possible, compensating controls include enforcing Site Isolation (enabled by default in modern Chrome - verify via chrome://flags) to keep cross-origin renderers in separate processes, restricting Chrome to known-good sites via enterprise URL allowlists (trade-off: breaks general browsing), and ensuring strict OS-level sandboxing remains intact (no --no-sandbox flag, no disabled seccomp), since the bug yields renderer-bound code execution that depends on a separate sandbox escape to be fully weaponized.