What is the CVSS score of CVE-2026-10020?

CVE-2026-10020 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-10020?

Google Chrome for Android versions below 148.0.7778.216 contain a sandbox escape vulnerability that allows attackers who have already compromised the browser's rendering engine to achieve full device…. A patch is available.

How to fix or mitigate CVE-2026-10020?

Within 24 hours: Identify Chrome for Android deployment scope across organizational and BYOD devices; issue advisory notifying users of patch availability. Within 7 days: Push automated updates to Chrome version 148.0.7778.216 or later, or publish documented deployment steps for manual installation. Within 30 days: Audit update compliance; verify ≥95% of devices running patched version; review device logs for anomalous behavior during unpatched exposure window.

Google Chrome CVE-2026-10020

EUVD-2026-33162 HIGH

Improper Input Validation (CWE-20)

2026-05-28 Chrome

GHSA-w93m-f8fx-95gr

Information Disclosure Google

8.3

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.2 MEDIUM

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 16:28 vuln.today

CVSS changed

May 29, 2026 - 16:27 NVD

8.3 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 8.3

DescriptionCVE.org

Insufficient validation of untrusted input in Skia in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Sandbox escape in Google Chrome on Android prior to 148.0.7778.216 allows a remote attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page targeting the Skia graphics library. Exploitation requires user interaction (visiting a malicious page) and chained renderer compromise, raising attack complexity, but the resulting scope change and full CIA impact make it a high-severity issue. No public exploit identified at time of analysis and EPSS exploitation probability is very low (0.05%, 15th percentile).

Technical ContextAI

The flaw resides in Skia, the open-source 2D graphics library used by Chromium (and other projects) to rasterize vector graphics, fonts, and images. Per CWE-20 (Improper Input Validation), Skia fails to adequately validate untrusted input supplied via crafted HTML/graphics content, which a renderer-resident attacker can leverage to corrupt state in a more privileged process and escape the sandbox boundary that normally isolates the renderer from the host OS. The CPE (cpe:2.3:a:google:chrome:*) indicates Chrome on Android is the affected product, and because Skia is shared with Chromium-derived browsers, downstream Chromium forks on Android may also be impacted pending their own backports.

RemediationAI

Vendor-released patch: update Google Chrome on Android to 148.0.7778.216 or later, per the Chrome Releases advisory (https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html); enterprises managing Android fleets via MDM should push the update through Google Play managed configurations. No vendor-published workaround exists, but because exploitation requires the renderer to be compromised first, compensating controls focus on preventing that initial step: enforce Site Isolation (default in modern Chrome), restrict installation of untrusted browser extensions, and where feasible deploy Android Enterprise work profiles that block sideloaded apps and untrusted browsing, accepting the trade-off of reduced user flexibility. For high-risk users, enable Chrome's Enhanced Safe Browsing and consider Android's lockdown mode equivalents, noting these add latency to page loads and may break some legitimately complex sites. Downstream Chromium-based Android browsers should be monitored for their own patched releases.