What is the CVSS score of CVE-2026-10022?

CVE-2026-10022 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-10022?

Google Chrome contains a vulnerability allowing malicious extensions to bypass sandbox protections and execute code with access to user data.. A patch is available.

How to fix or mitigate CVE-2026-10022?

24 hours: Identify Chrome deployments and alert users to avoid untrusted extension installations. 7 days: Deploy Chrome version 148.0.7778.216 or later across all endpoints through patch management; implement extension allowlist policies where available. 30 days: Conduct end-user security training on extension vetting practices and audit organizational extension inventory.

Google Chrome CVE-2026-10022

EUVD-2026-33164 HIGH

Access of Resource Using Incompatible Type (Type Confusion) (CWE-843)

2026-05-28 Chrome

GHSA-rxxm-p26x-j53p

Google Memory Corruption RCE Chrome

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Red Hat

8.2 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jun 05, 2026 - 02:28 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 05, 2026 - 02:27 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 05, 2026 - 02:22 vuln.today

cvss_changed

CVSS changed

Jun 05, 2026 - 02:22 NVD

8.8 (HIGH) 7.5 (HIGH)

Analysis Generated

May 29, 2026 - 12:25 vuln.today

CVSS changed

May 29, 2026 - 12:22 NVD

8.8 (HIGH)

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

CVE Published

May 28, 2026 - 22:25 nvd

HIGH 8.8

DescriptionCVE.org

Type Confusion in V8 in Google Chrome prior to 148.0.7778.216 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code inside a sandbox via a crafted Chrome Extension. (Chromium security severity: Medium)

AnalysisAI

Type confusion in the V8 JavaScript engine of Google Chrome before 148.0.7778.216 enables sandboxed arbitrary code execution when a user is convinced to install a malicious browser extension that delivers a crafted payload. The flaw carries a CVSS 7.5 (AV:N/AC:H/PR:N/UI:R) and is reported by Google's Chrome team, with no public exploit identified at time of analysis and a very low EPSS of 0.02%. Impact remains constrained to the renderer sandbox, but full confidentiality, integrity, and availability loss inside that boundary is possible.

Technical ContextAI

V8 is Chrome's open-source JavaScript and WebAssembly engine, and CWE-843 (Access of Resource Using Incompatible Type / type confusion) here means V8 operates on an object assuming one type while it is actually another, allowing memory to be reinterpreted in attacker-controlled ways. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* identifies all Chrome desktop builds prior to 148.0.7778.216 across platforms. Because the trigger path is a crafted Chrome Extension, the malicious JavaScript executes with the elevated privileges and APIs granted to extension contexts before pivoting through V8's type system to corrupt object representations and gain code execution inside the renderer/extension sandbox.

RemediationAI

Vendor-released patch: Google Chrome 148.0.7778.216 - upgrade all desktop installations to that version or later via the stable channel update documented at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html, and verify rollout for Chromium-based browsers once their respective vendors ship the V8 update. As a compensating control until patching completes, enforce an extension allowlist via the ExtensionInstallAllowlist / ExtensionInstallBlocklist enterprise policies and require Chrome Web Store provenance, which prevents installation of arbitrary extensions but adds operational overhead for legitimate developer or marketing workflows. Additional defensive measures include disabling Developer Mode for extensions via the DeveloperToolsAvailability policy to block sideloaded unpacked extensions (with the trade-off that internal devs lose local extension testing) and user-awareness messaging about not installing untrusted extensions; do not rely on the renderer sandbox alone as mitigation since the vulnerability executes within it.