What is the CVSS score of CVE-2026-10882?

CVE-2026-10882 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-10882?

Google Chrome versions prior to 149.0.7827.53 contain a critical remote code execution vulnerability in the Network component that could allow attackers to compromise employee workstations when users…. A patch is available.

How to fix or mitigate CVE-2026-10882?

Within 24 hours: Alert IT security and establish Chrome patching priority. Identify current Chrome deployment scope across endpoints. Within 7 days: Deploy Chrome version 149.0.7827.53 via standard patch management process to all systems. Within 30 days: Verify 100% patch deployment completion, review endpoint security logs for exploitation attempts, and confirm no systems remain on affected versions.

Google Chrome CVE-2026-10882

EUVD-2026-34545 HIGH

Use After Free (CWE-416)

2026-06-04 chrome-cve-admin@google.com

GHSA-3267-vg73-vrv9

RCE Denial Of Service Google Use After Free Memory Corruption

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 04:31 vuln.today

CVSS changed

Jun 05, 2026 - 02:22 NVD

8.8 (HIGH)

CVE Published

Jun 04, 2026 - 23:16 nvd

HIGH 8.8

CVE Published

Jun 04, 2026 - 23:16 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Use after free in Network in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)

AnalysisAI

Remote code execution in Google Chrome versions prior to 149.0.7827.53 stems from a use-after-free flaw in the Network component, allowing a remote attacker to execute arbitrary code within the renderer process when a user visits a crafted HTML page. Google rated this issue Critical at the Chromium level, and a vendor patch is available; no public exploit identified at time of analysis.

Technical ContextAI

The flaw is classified as CWE-416 (Use After Free) inside Chrome's Network stack, which handles HTTP(S), WebSocket, and other network protocol parsing and lifetime management of request/response objects. Use-after-free conditions in this subsystem typically arise when a network-related object is freed while still referenced by another handler, allowing an attacker to reclaim the freed memory with controlled data and influence subsequent dereferences. Affected products per CPE-equivalent data: Google Chrome desktop builds at versions strictly below 149.0.7827.53 across the Stable channel, with Chromium-derived browsers (Edge, Brave, Opera, Vivaldi) typically inheriting the same defect until they rebase.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 (Stable channel). Update Chrome on Windows, macOS, and Linux endpoints to 149.0.7827.53 or later via the built-in updater or enterprise management (Chrome Browser Cloud Management, MSI/PKG redeploy) as detailed at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html, and trigger a browser restart to load the new binary. For Chromium-based derivatives (Edge, Brave, Opera, Vivaldi), apply the corresponding vendor build that incorporates the upstream fix tracked at https://issues.chromium.org/issues/503420443. Until patching completes, compensating controls include enforcing Chrome's Site Isolation (already default), enabling Enhanced Safe Browsing to block known malicious pages, restricting browsing to a curated allowlist via group policy (URLBlocklist/URLAllowlist), and isolating high-risk web browsing in a remote browser or VM - note that allowlisting breaks general web usability and Safe Browsing offers no protection against unknown attacker-controlled pages.