What is the CVSS score of CVE-2026-10886?

CVE-2026-10886 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-10886?

A critical sandbox escape vulnerability in Google Chrome (CVE-2026-10886, CVSS 9.6) enables attackers to bypass browser security controls and gain unauthorized system access through malicious…. A patch is available.

How to fix or mitigate CVE-2026-10886?

Within 24 hours: Identify all systems running Google Chrome and determine which are below version 149.0.7827.53. Within 7 days: Deploy Chrome 149.0.7827.53 or later organization-wide using your standard software distribution mechanism (Windows Update, MDM, or equivalent). Within 30 days: Verify complete deployment through audit and ensure organizational policy enforces automatic Chrome updates going forward.

Google Chrome CVE-2026-10886

EUVD-2026-34549 CRITICAL

Use After Free (CWE-416)

2026-06-04 chrome-cve-admin@google.com

GHSA-vp2w-xx74-hpqr

Denial Of Service Google Use After Free Memory Corruption

9.6

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 02:22 vuln.today

CVSS changed

Jun 05, 2026 - 02:22 NVD

9.6 (CRITICAL)

CVE Published

Jun 04, 2026 - 23:16 nvd

CRITICAL 9.6

CVE Published

Jun 04, 2026 - 23:16 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Use after free in FileSystem in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

AnalysisAI

Sandbox escape in Google Chrome versions prior to 149.0.7827.53 allows remote attackers to exploit a use-after-free condition in the FileSystem component via a crafted HTML page, with user interaction required. Google has rated the underlying Chromium issue as Critical severity, and a vendor patch is available; no public exploit identified at time of analysis, though the high CVSS score (9.6) and scope-changed impact warrant rapid patching.

Technical ContextAI

The vulnerability resides in Chrome's FileSystem component, which implements browser-side file storage APIs allowing web content to read and write to a sandboxed virtual filesystem. The root cause is CWE-416 (Use After Free), a memory-corruption class where freed heap memory is referenced again, often allowing an attacker to control the contents of the dangling pointer's target object. Because Chrome's renderer process handles untrusted web content within a sandbox, a successful UAF in FileSystem can be leveraged to escape that sandbox and execute code in a higher-privileged process context - confirmed by the CVSS scope-changed (S:C) designation and the description explicitly noting 'sandbox escape.'

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 - upgrade immediately via Chrome's automatic update channel or by manually triggering Help > About Google Chrome and restarting the browser. Enterprise administrators should push the update through managed deployment tools (Google Admin console, SCCM, Intune, Jamf) and verify version compliance on managed endpoints. Until patching completes, compensating controls include restricting browsing to trusted sites via web proxy/SWG policies, disabling the FileSystem API via enterprise policy where feasible (note: this will break legitimate web apps that depend on persistent storage), and ensuring Chrome's site isolation and sandbox hardening flags remain enabled - these reduce but do not eliminate exposure. Downstream Chromium-based browsers (Edge, Brave, Opera, Electron apps) should be updated as soon as their vendors ship a rebased build; see https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for the upstream advisory.