What is the CVSS score of CVE-2026-10884?

CVE-2026-10884 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-10884?

A sandbox escape vulnerability in Google Chrome versions prior to 149.0.7827.53 could allow attackers to escape browser isolation and compromise entire systems.. A patch is available.

How to fix or mitigate CVE-2026-10884?

Within 24 hours: Deploy Google Chrome version 149.0.7827.53 or later across all managed endpoints, prioritizing business-critical and high-value systems. Within 7 days: Verify minimum 95% deployment completion and remediate any non-compliant systems. Within 30 days: Achieve 100% deployment, enable Chrome auto-updates organization-wide, and monitor logs for exploitation attempts.

Google Chrome CVE-2026-10884

EUVD-2026-34547 HIGH

Use After Free (CWE-416)

2026-06-04 chrome-cve-admin@google.com

GHSA-3f68-6wxq-x593

Denial Of Service Google Use After Free Memory Corruption

8.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.7 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 04:31 vuln.today

CVSS changed

Jun 05, 2026 - 02:22 NVD

8.3 (HIGH)

CVE Published

Jun 04, 2026 - 23:16 nvd

HIGH 8.3

CVE Published

Jun 04, 2026 - 23:16 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Use after free in Chromecast in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

AnalysisAI

Sandbox escape in Google Chrome versions prior to 149.0.7827.53 enables a remote attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page targeting a use-after-free flaw in the Chromecast component. Google classifies the underlying issue as Critical severity, and no public exploit has been identified at time of analysis. The bug requires chaining with a separate renderer compromise, which lowers standalone exploitability but makes it valuable as the second stage of a full browser exploit chain.

Technical ContextAI

The vulnerability is a CWE-416 use-after-free in Chrome's Chromecast integration, the browser-side component responsible for media casting to Google Cast receivers. Use-after-free bugs occur when memory is freed but a dangling pointer is later dereferenced, allowing an attacker who controls heap layout to substitute attacker-chosen objects and gain arbitrary read/write or control-flow primitives. Because Chromecast lives in a higher-privileged browser process than the renderer sandbox, a UAF here is well-positioned to serve as a sandbox-escape primitive when triggered from a compromised renderer. Chromium tracks the underlying issue as 503617302, and the fix shipped in the Stable channel desktop update referenced in the Chrome Releases blog.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 or later on the Stable channel for desktop - upgrade immediately via Chrome's built-in updater or managed deployment tooling, then relaunch the browser to apply. Administrators should track downstream Chromium-based browsers and update them as their vendors ship the merged fix. As an interim compensating control where patching is delayed, disabling the Chromecast/Media Router functionality via the enterprise policy EnableMediaRouter=false reduces exposure to the vulnerable code path at the cost of breaking 'Cast' to Chromecast and Google TV devices for end users; this does not eliminate the renderer-side prerequisite bug but removes the specific sandbox-escape sink. Reference the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html and Chromium issue https://issues.chromium.org/issues/503617302 for tracking.