What is the CVSS score of CVE-2026-10016?

CVE-2026-10016 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-10016?

Google Chrome versions prior to 148.0.7778.216 contain a high-severity remote code execution vulnerability that allows attackers to execute arbitrary code when users visit compromised websites; no…. A patch is available.

How to fix or mitigate CVE-2026-10016?

Within 24 hours: Announce the security update (Chrome version 148.0.7778.216 or later) to all staff and enable automatic updates. Within 7 days: Verify via endpoint management or MDM that at least 90% of Chrome instances are on the patched version. Within 30 days: Conduct full inventory reconciliation to confirm 100% compliance and review any lagging systems for evidence of compromise.

Google Chrome CVE-2026-10016

EUVD-2026-33158 HIGH

Use After Free (CWE-416)

2026-05-28 Chrome

GHSA-hg84-96ph-3rr9

Use After Free RCE Memory Corruption Google Denial Of Service Chrome

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 12:24 vuln.today

CVSS changed

May 29, 2026 - 12:22 NVD

8.8 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in DOM in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome versions prior to 148.0.7778.216 allows attackers to run arbitrary code inside the browser's renderer sandbox through a crafted HTML page that triggers a use-after-free condition in the DOM implementation. The flaw, rated High severity by Chromium and carrying a CVSS 8.8 score, requires only that a victim visit a malicious or compromised webpage, making it well-suited for drive-by attacks despite no public exploit identified at time of analysis.

Technical ContextAI

The vulnerability is a CWE-416 Use-After-Free in Blink's DOM (Document Object Model) component, the engine responsible for parsing and manipulating HTML/JavaScript-driven document trees in Chromium-based browsers. Use-after-free bugs arise when memory is freed but a dangling pointer remains in use, allowing an attacker who can control subsequent allocations to place attacker-controlled data where a valid object is expected, leading to type confusion and ultimately arbitrary code execution. The affected component (cpe:2.3:a:google:chrome:*) is Google Chrome's rendering engine, which runs in a sandboxed process - meaning successful exploitation initially yields code execution constrained by the Chrome sandbox, requiring a chained sandbox escape for full host compromise.

RemediationAI

Upgrade Chrome to version 148.0.7778.216 or later on all desktop platforms - this is a vendor-released patch confirmed via the Chrome Stable channel update at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html. Most enterprise deployments will receive this through Chrome's auto-update mechanism, but organizations using managed update controls should verify rollout and force a browser restart since the running process retains the vulnerable code until relaunch. As an interim compensating control while patching, consider enabling Chrome's Site Isolation (default on desktop) and Enhanced Safe Browsing to reduce drive-by exposure, and review enterprise policies such as URLBlocklist to restrict untrusted sites; note these controls do not eliminate the vulnerability and may break some intranet workflows. Downstream Chromium-based browsers (Edge, Brave, Opera, Vivaldi, Electron apps) should also be updated once their vendors ship the merged fix.