What is the CVSS score of CVE-2026-10019?

CVE-2026-10019 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-10019?

Google Chrome versions prior to 148.0.7778.216 contain a cross-origin data leakage vulnerability that allows attackers to steal sensitive information from websites users are logged into by exploiting…. A patch is available.

How to fix or mitigate CVE-2026-10019?

Within 24 hours: Alert all Chrome users to update immediately to version 148.0.7778.216 or later; validate auto-update settings are enabled. Within 7 days: Conduct audits of 10% of workstations to confirm patch deployment and verify no blocking policies prevent updates. Within 30 days: Run endpoint scanning across all systems to achieve 100% compliance with Chrome 148.0.7778.216 or later; escalate any blockers to IT leadership.

Google Chrome CVE-2026-10019

EUVD-2026-33161 HIGH

External Control of Assumed-Immutable Web Parameter (CWE-472)

2026-05-28 Chrome

GHSA-q2hx-7c42-vrhr

Google Information Disclosure Red Hat Suse Chrome

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Red Hat

7.4 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 17:22 vuln.today

CVSS changed

May 29, 2026 - 17:22 NVD

8.8 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 8.8

DescriptionCVE.org

Integer overflow in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Cross-origin data leakage in Google Chrome versions prior to 148.0.7778.216 stems from an integer overflow in the ANGLE graphics translation layer, allowing a remote attacker who lures a user to a crafted HTML page to bypass same-origin protections and exfiltrate sensitive data from other domains. The flaw carries a CVSS 8.8 rating due to network reachability and high impact across confidentiality, integrity, and availability, though Chromium itself rates the severity as Medium. EPSS is very low at 0.03% (11th percentile) and no public exploit identified at time of analysis, indicating limited near-term exploitation pressure despite the high CVSS.

Technical ContextAI

ANGLE (Almost Native Graphics Layer Engine) is Chromium's translation library that maps WebGL and other OpenGL ES API calls onto the host platform's native graphics stack (Direct3D on Windows, Metal on macOS, Vulkan/OpenGL on Linux), and it is exposed to untrusted web content through the renderer process. CWE-472 (External Control of Assumed-Immutable Web Parameter) is unusual for a graphics-layer integer overflow; the more common root-cause class for ANGLE overflows is CWE-190, and the assigned CWE may reflect how attacker-controlled values from the page flow into size or offset calculations that were assumed trusted. The CPE (cpe:2.3:a:google:chrome:*) covers all Chrome variants, and the overflow leads to cross-origin data leakage rather than direct memory corruption disclosure, suggesting the integer wrap causes out-of-bounds reads from buffers belonging to other origins rendered via GPU-accelerated content.

RemediationAI

Upgrade Google Chrome to version 148.0.7778.216 or later on the Stable channel per the vendor-released patch documented in the Chrome Releases blog (https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html) and tracked at https://issues.chromium.org/issues/505056913 and https://nvd.nist.gov/vuln/detail/CVE-2026-10019. For managed environments, push the update via enterprise policy (Chrome Browser Cloud Management or GPO) and verify by checking chrome://version. If patching must be delayed, compensating controls include disabling hardware acceleration via the '#disable-accelerated-2d-canvas' and related flags or the HardwareAccelerationModeEnabled enterprise policy to force software rendering (trade-off: degraded WebGL/canvas performance and broken behavior on graphics-heavy sites), and restricting browsing to trusted internal sites via web filtering until updates roll out. Ensure Chromium-derivative browsers (Edge, Brave, Opera) are also updated to versions that pull in the fixed ANGLE code.