What is the CVSS score of CVE-2026-10890?

CVE-2026-10890 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-10890?

Google Chrome versions before 149.0.7827.53 contain a heap corruption vulnerability that allows attackers on the same network to execute arbitrary code on employee machines without authentication,…. A patch is available.

How to fix or mitigate CVE-2026-10890?

24 hours: Inventory Chrome versions across all endpoints using patch management and mobile device management systems. Communicate patch requirement to IT operations and end-user teams. 7 days: Deploy Chrome 149.0.7827.53 or later to all systems, prioritizing devices on shared networks (Wi-Fi, guest networks). 30 days: Audit endpoint telemetry to verify 100% compliance; manually remediate any systems still running pre-149.0.7827.53 builds.

Google Chrome CVE-2026-10890

EUVD-2026-34553 HIGH

Use After Free (CWE-416)

2026-06-04 chrome-cve-admin@google.com

GHSA-xrv4-rvr5-75gv

Denial Of Service Google Use After Free Memory Corruption

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 02:24 vuln.today

CVSS changed

Jun 05, 2026 - 02:22 NVD

8.8 (HIGH)

CVE Published

Jun 04, 2026 - 23:16 nvd

HIGH 8.8

CVE Published

Jun 04, 2026 - 23:16 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Use after free in Cast in Google Chrome prior to 149.0.7827.53 allowed an attacker on the local network segment to potentially exploit heap corruption via malicious network traffic. (Chromium security severity: Critical)

AnalysisAI

Heap corruption in Google Chrome's Cast component prior to version 149.0.7827.53 allows adjacent-network attackers to trigger a use-after-free condition through crafted network traffic, potentially leading to arbitrary code execution within the renderer. Chromium rates the underlying severity as Critical, and no public exploit identified at time of analysis, though the AV:A vector means any attacker sharing the victim's LAN or Wi-Fi segment can attempt exploitation without authentication or user interaction.

Technical ContextAI

The flaw resides in Chrome's Cast subsystem, which implements the Google Cast protocol used to discover and stream media to Chromecast and other receiver devices over the local network (typically via mDNS/DIAL/SSDP discovery and DTLS-protected media channels). CWE-416 (Use After Free) indicates that an object in the Cast component is freed while a dangling pointer remains reachable; subsequent dereference of that pointer corrupts the heap, which an attacker can shape via malicious network frames to overwrite control data such as vtable pointers. Per the affected-products data, this impacts Chrome desktop builds prior to 149.0.7827.53 across the Chromium codebase; downstream Chromium-based browsers (Edge, Brave, Opera, Vivaldi) that share the Cast implementation are also likely affected pending their own respins.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 or later via the Stable channel - update by opening chrome://settings/help and restarting the browser, or push the update through enterprise management (Chrome Browser Cloud Management, Group Policy, or MDM) referencing the advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. For Chromium-derivative browsers, apply the vendor's respun build once available and track the Chromium bug at https://issues.chromium.org/issues/513136593. Where immediate patching is not possible, compensating controls include disabling the Media Router / Cast feature via the EnableMediaRouter=false enterprise policy (trade-off: users lose Chromecast and 'Cast tab' functionality), isolating endpoints onto trusted VLANs that block adjacent untrusted devices from reaching the Cast discovery ports (mDNS/UDP 5353, SSDP/UDP 1900, and Cast TCP 8008/8009), and instructing mobile users to avoid open public Wi-Fi until patched since AV:A exposure is dominated by shared wireless segments.