What is the CVSS score of CVE-2026-10017?

CVE-2026-10017 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-10017?

Google Chrome Headless component (versions prior to 148.0.7778.216) contains a sandbox escape vulnerability that allows attackers with renderer process access to break browser isolation and escalate…. A patch is available.

How to fix or mitigate CVE-2026-10017?

24 hours: Audit all systems running Google Chrome Headless and document current versions and deployment contexts. 7 days: Update Chrome to version 148.0.7778.216 or later on all affected systems; prioritize production services first. 30 days: Verify patch deployment through vulnerability scanning, enable logging on Chrome renderer processes to detect exploitation attempts, and document the patching completion.

Google Chrome CVE-2026-10017

EUVD-2026-33159 HIGH

Out-of-bounds Read (CWE-125)

2026-05-28 Chrome

GHSA-8rpv-xx2v-w955

Buffer Overflow Information Disclosure Google

8.3

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.0 MEDIUM

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 16:28 vuln.today

CVSS changed

May 29, 2026 - 16:27 NVD

8.3 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 8.3

DescriptionCVE.org

Out of bounds read in Headless in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Sandbox escape in Google Chrome's Headless component prior to version 148.0.7778.216 allows a remote attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page. The flaw is an out-of-bounds read (CWE-125) reported by the Chrome team itself; no public exploit is identified at the time of analysis and EPSS is very low (0.03%), but the high CVSS (8.3) reflects scope-changed sandbox escape impact.

Technical ContextAI

The vulnerability resides in Chrome's Headless mode, the embeddable rendering subsystem used for headless browsing, automation (e.g., Puppeteer), and PDF/printing pipelines built on Chromium. CWE-125 (out-of-bounds read) indicates the affected code reads memory beyond an allocated buffer, which in a browser sandbox context can leak pointers, object metadata, or cross-process handles useful for bypassing isolation between the renderer sandbox and higher-privileged browser/host processes. Per CPE cpe:2.3:a:google:chrome:*, the issue affects the Chrome desktop product across platforms up to but not including the fixed Stable channel build 148.0.7778.216.

RemediationAI

Vendor-released patch: Chrome Stable 148.0.7778.216 - upgrade all Chrome desktop installations to this version or later via the standard Chrome update channel and restart the browser to apply the fix, per the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html. No vendor-supplied workaround is documented; as a compensating control until patching completes, organizations can enforce update policy via the Chrome ADMX/MDM 'Relaunch notification' settings to force restarts, and reduce headless automation exposure by restricting which sites scripted/headless Chrome instances visit (untrusted HTML is the precondition for triggering the bug). Disabling Headless mode where it is not needed (e.g., removing --headless flags in CI runners or server-side renderers handling untrusted input) limits the affected attack surface, with the trade-off of breaking any automation or PDF/print pipelines that rely on it.