What is the CVSS score of CVE-2026-10883?

CVE-2026-10883 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-10883?

Google Chrome versions before 149.0.7827.53 contain a critical heap corruption flaw enabling remote code execution when users visit malicious webpages, directly threatening the security of all Chrome…. A patch is available.

How to fix or mitigate CVE-2026-10883?

Within 24 hours: Inventory Chrome deployments across your organization and flag systems with access to sensitive data for priority patching. Within 7 days: Deploy Google Chrome version 149.0.7827.53 or later organization-wide using your endpoint management platform with mandatory enforcement. Within 30 days: Verify 100% patch compliance through your MDM/EDR tools and document any legacy systems unable to patch for alternative security controls.

Google Chrome CVE-2026-10883

EUVD-2026-34546 HIGH

Out-of-bounds Write (CWE-787)

2026-06-04 chrome-cve-admin@google.com

GHSA-6jj2-84mp-c72m

Buffer Overflow Google Memory Corruption

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 04:32 vuln.today

CVSS changed

Jun 05, 2026 - 02:22 NVD

8.8 (HIGH)

CVE Published

Jun 04, 2026 - 23:16 nvd

HIGH 8.8

CVE Published

Jun 04, 2026 - 23:16 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Type Confusion in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)

AnalysisAI

Heap corruption in Google Chrome's ANGLE graphics translation layer prior to version 149.0.7827.53 allows remote attackers to potentially achieve code execution by enticing a user to visit a crafted HTML page. Chromium rates the severity as Critical and the CVSS score is 8.8 (High), but no public exploit identified at time of analysis. The flaw is a type confusion issue that maps to CWE-787 (out-of-bounds write), affecting the browser's WebGL/graphics rendering path.

Technical ContextAI

ANGLE (Almost Native Graphics Layer Engine) is the abstraction library Chrome uses to translate OpenGL ES API calls into native graphics APIs such as Direct3D, Metal, or Vulkan, enabling WebGL and other GPU-accelerated web content across platforms. A type confusion bug in ANGLE means the engine interprets a memory object as a different type than it actually is, which in C++ graphics code typically corrupts heap metadata or object vtables. The CWE-787 classification (out-of-bounds write) indicates the type confusion leads to writing beyond allocated buffer boundaries, the same primitive that has historically yielded reliable browser RCE via heap grooming and pointer overwrites. Because ANGLE is reachable from any web page that uses WebGL or 2D canvas acceleration, the attack surface is exposed to all untrusted web content the browser renders.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 - update Chrome via the built-in updater or by downloading from Google and restarting the browser to complete the update, as documented in the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. For managed fleets, push the update via Group Policy, Intune, Jamf, or your endpoint management tool and verify chrome://version reports 149.0.7827.53 or later; downstream Chromium browsers (Edge, Brave, Opera, Electron apps) should be updated as their vendors ship the corresponding ANGLE fix. As an interim compensating control where immediate patching is not possible, WebGL can be disabled via the enterprise policy 'HardwareAccelerationModeEnabled=false' or by toggling chrome://flags, which reduces the ANGLE attack surface at the cost of breaking WebGL-dependent sites and degrading graphics performance; restricting browsing to trusted sites via SafeSites/URL allowlists offers partial mitigation but does not protect against compromised or malvertising-laden trusted domains.