What is the CVSS score of CVE-2026-10881?

CVE-2026-10881 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-10881?

Google Chrome versions prior to 149.0.7827.53 contain a critical sandbox escape vulnerability allowing remote code execution through a crafted HTML page.. A patch is available.

How to fix or mitigate CVE-2026-10881?

Within 24 hours: Audit Chrome deployments across the organization and identify systems running affected versions. Within 7 days: Deploy Chrome 149.0.7827.53 or later to all systems, prioritizing internet-exposed endpoints and systems handling sensitive data. Within 30 days: Verify complete deployment through EDR/endpoint management tools and implement automated update enforcement to prevent regression.

Google Chrome CVE-2026-10881

EUVD-2026-34544 CRITICAL

Out-of-bounds Read (CWE-125)

2026-06-04 chrome-cve-admin@google.com

GHSA-whg6-qpwj-7565

Buffer Overflow Information Disclosure Google

9.6

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 04:30 vuln.today

CVSS changed

Jun 05, 2026 - 02:22 NVD

9.6 (CRITICAL)

CVE Published

Jun 04, 2026 - 23:16 nvd

CRITICAL 9.6

CVE Published

Jun 04, 2026 - 23:16 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Out of bounds read and write in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

AnalysisAI

Sandbox escape in Google Chrome's ANGLE graphics layer prior to version 149.0.7827.53 allows a remote attacker to trigger an out-of-bounds read and write via a crafted HTML page, with a CVSS 9.6 reflecting scope change and high impact across confidentiality, integrity, and availability. The flaw was rated Critical internally by Chromium and reported by Google's own CVE admin team; no public exploit identified at time of analysis, and CISA SSVC currently lists exploitation status as none.

Technical ContextAI

ANGLE (Almost Native Graphics Layer Engine) is the translation layer Chrome uses to convert OpenGL ES API calls into the underlying platform graphics API (Direct3D on Windows, Metal on macOS, Vulkan/GL on Linux/Android), and is reachable from web content through WebGL and WebGPU. The CWE-125 root cause (out-of-bounds read) combined with an out-of-bounds write - as noted in the description and reinforced by the 'Buffer Overflow' and 'Information Disclosure' tags - typically arises from missing or incorrect bounds checking when parsing shader inputs, vertex buffers, or texture parameters supplied by attacker-controlled JavaScript. Because ANGLE code runs inside the GPU process, memory corruption there is a well-known path to escaping Chrome's renderer sandbox by exploiting the more privileged GPU process boundary.

RemediationAI

Upgrade Google Chrome to the vendor-released patch version 149.0.7827.53 or later on all desktop platforms, as published in the Chrome stable channel update advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html; the Chromium issue tracker entry (https://issues.chromium.org/issues/498904293) is referenced but access is typically restricted until further disclosure. As compensating controls until patching completes, administrators can disable hardware-accelerated graphics via the 'HardwareAccelerationModeEnabled' enterprise policy (which forces software rasterization and largely sidesteps ANGLE/WebGL code paths, at a noticeable performance cost for video, canvas, and WebGL workloads), or block WebGL/WebGPU via site-isolation and content policies for high-risk user populations (which will break legitimate 3D, mapping, and ML-in-browser features). Downstream Chromium-based browsers should be updated as their vendors ship the merged fix.