What is the CVSS score of CVE-2026-10889?

CVE-2026-10889 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-10889?

Google Chrome versions before 149.0.7827.53 contain a sandbox escape vulnerability in the graphics engine that enables attackers with code execution in the browser to escalate to system-level access.. A patch is available.

How to fix or mitigate CVE-2026-10889?

No public exploit identified at time of analysis. Within 24 hours: Issue security alert and inventory Chrome versions across the organization. Within 7 days: Deploy Chrome 149.0.7827.53 or later across all systems, prioritizing user-facing workstations. Within 30 days: Verify complete deployment.

Google Chrome CVE-2026-10889

EUVD-2026-34552 HIGH

Out-of-bounds Read (CWE-125)

2026-06-04 chrome-cve-admin@google.com

GHSA-3hqj-63hv-2g5h

Buffer Overflow Information Disclosure Google

8.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.2 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 02:24 vuln.today

CVSS changed

Jun 05, 2026 - 02:22 NVD

8.3 (HIGH)

CVE Published

Jun 04, 2026 - 23:16 nvd

HIGH 8.3

CVE Published

Jun 04, 2026 - 23:16 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Out of bounds read in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

AnalysisAI

Out-of-bounds read in the ANGLE graphics layer of Google Chrome before 149.0.7827.53 enables a remote attacker who has already compromised the renderer process to potentially escape the browser sandbox via a crafted HTML page. Chromium rates the underlying issue Critical severity, and while no public exploit has been identified at time of analysis, the bug is in a historically targeted attack surface (GPU/ANGLE) frequently abused in renderer-to-broker escape chains.

Technical ContextAI

ANGLE (Almost Native Graphics Layer Engine) is Chromium's translation layer that converts WebGL/OpenGL ES API calls into the underlying native graphics API (Direct3D on Windows, Metal on macOS, Vulkan/OpenGL on Linux). It runs partly in the more-privileged GPU process that the sandboxed renderer communicates with via Mojo IPC, making ANGLE a classic boundary between the low-privilege renderer and higher-privilege browser components. The root cause is CWE-125 (Out-of-bounds Read), where attacker-controlled input from a compromised renderer drives ANGLE to read beyond an allocated buffer, leaking memory contents or corrupting state used by the GPU process - a primitive commonly chained to defeat ASLR or pivot into a sandbox escape.

RemediationAI

Vendor-released patch: update Google Chrome to 149.0.7827.53 or later via the Stable channel auto-update, then restart the browser to apply (see the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html and the upstream tracker at https://issues.chromium.org/issues/513003797). Administrators managing fleets should force-push the update through Chrome Browser Cloud Management, Group Policy, or MDM and verify the version on endpoints, and downstream Chromium-based browser users should install whichever build incorporates the equivalent Chromium merge. As a compensating control until patched, disable hardware acceleration via chrome://settings (Advanced → System → 'Use graphics acceleration when available'), which routes WebGL through software rendering and reduces ANGLE attack surface at the cost of degraded video/3D performance; alternatively, deploy the enterprise policy to disable WebGL (set 'Disable3DAPIs') for high-risk users, with the trade-off that legitimate WebGL/WebGPU content will break.