What is the CVSS score of CVE-2026-10887?

CVE-2026-10887 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by CVE-2026-10887?

Google Chrome on macOS prior to version 149.0.7827.53 contains a critical use-after-free vulnerability in the Chromoting (Chrome Remote Desktop) component enabling remote code execution.. A patch is available.

How to fix or mitigate CVE-2026-10887?

Within 24 hours: Audit inventory to identify all macOS systems running Chrome and document current versions. Within 7 days: Deploy Chrome version 149.0.7827.53 or later across all macOS systems using automatic updates or MDM/configuration management. Within 30 days: Perform full verification sweep to confirm zero instances of pre-149.0.7827.53 Chrome remain in production or managed fleet.

Google Chrome CVE-2026-10887

EUVD-2026-34550 HIGH

Use After Free (CWE-416)

2026-06-04 chrome-cve-admin@google.com

GHSA-jj7h-g82v-3vhc

Google Memory Corruption RCE Use After Free Denial Of Service Red Hat Suse Chrome

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.8 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 02:23 vuln.today

CVSS changed

Jun 05, 2026 - 02:22 NVD

8.1 (HIGH)

CVE Published

Jun 04, 2026 - 23:16 nvd

HIGH 8.1

CVE Published

Jun 04, 2026 - 23:16 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Use after free in Chromoting in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code via malicious network traffic. (Chromium security severity: Critical)

AnalysisAI

Remote code execution in Google Chrome on macOS prior to 149.0.7827.53 stems from a use-after-free flaw in the Chromoting (Chrome Remote Desktop) component, allowing remote attackers to execute arbitrary code by delivering malicious network traffic. Google's Chromium team rates the underlying defect as Critical severity, and no public exploit has been identified at time of analysis, though the bug class historically attracts in-the-wild exploitation against browser users.

Technical ContextAI

Chromoting is the internal name for Google's Chrome Remote Desktop subsystem, which implements a remoting protocol over WebRTC/ICE to broker keyboard, mouse, and display traffic between a host and client. The defect is classified as CWE-416 (Use After Free): an object reference within the Chromoting code path is retained and later dereferenced after the underlying heap allocation has been freed, enabling an attacker who controls the freed-then-reused memory to hijack control flow. The flaw is macOS-specific per the advisory, meaning the affected code path or platform-specific allocator behavior on Darwin is required to reach the unsafe dereference, and exploitation typically proceeds by heap-grooming the renderer or remoting process to plant a controlled object in the freed slot.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 for macOS - upgrade immediately via the built-in updater or by relaunching Chrome, and verify the version under Help → About Google Chrome. Enterprise fleets managed via Jamf, Intune, or Google Admin should push the 149.0.7827.53 (or later) channel build and confirm rollout, prioritizing endpoints where Chrome Remote Desktop is used. As a compensating control until patching completes, disable or uninstall the Chrome Remote Desktop host and extension on macOS endpoints (chrome://extensions and removal of the CRD host package), which removes the vulnerable Chromoting attack surface at the cost of losing remote-assistance capability; network-layer blocking of outbound WebRTC/STUN traffic used by CRD is an alternative but will also break legitimate WebRTC video and meeting use cases. Downstream Chromium browser users on macOS should monitor their vendor for the merged fix and apply equivalent updates. Authoritative advisory: https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html.