What is the CVSS score of CVE-2026-10891?

CVE-2026-10891 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-10891?

Google Chrome on Linux is vulnerable to heap corruption (CVE-2026-10891) that enables remote code execution when users visit crafted websites.. A patch is available.

How to fix or mitigate CVE-2026-10891?

Within 24 hours: Inventory all Google Chrome installations on Linux systems and document current versions. Within 7 days: Deploy Google Chrome version 149.0.7827.53 or later across all affected Linux systems, prioritizing endpoints and systems accessing untrusted internet content. Within 30 days: Verify patch deployment to 100% of Chrome on Linux instances and complete compliance documentation.

Google Chrome CVE-2026-10891

EUVD-2026-34554 HIGH

Use After Free (CWE-416)

2026-06-04 chrome-cve-admin@google.com

GHSA-67gm-95g2-cp9v

Denial Of Service Google Use After Free Memory Corruption

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 02:25 vuln.today

CVSS changed

Jun 05, 2026 - 02:22 NVD

8.8 (HIGH)

CVE Published

Jun 04, 2026 - 23:16 nvd

HIGH 8.8

CVE Published

Jun 04, 2026 - 23:16 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Use after free in GFX in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)

AnalysisAI

Heap corruption in Google Chrome's GFX component on Linux prior to version 149.0.7827.53 allows remote attackers to potentially achieve code execution when a victim visits a crafted HTML page. Google rates the underlying Chromium issue as Critical severity, and a vendor patch is available; no public exploit identified at time of analysis.

Technical ContextAI

The flaw is a CWE-416 Use-After-Free in Chrome's GFX subsystem, which handles graphics primitives (rasterization, image decoding, and compositing) within the renderer process. Use-after-free bugs occur when a pointer to a freed heap object is dereferenced, enabling an attacker who can groom the heap (e.g., via JavaScript-allocated objects) to coerce the dangling pointer to reference attacker-controlled data and corrupt control-flow or virtual table pointers. The affected platform identified in the description is Linux desktop builds of Chrome, with the fix landing in stable channel build 149.0.7827.53.

RemediationAI

Apply the vendor-released patch by upgrading Linux Chrome to 149.0.7827.53 or later, available via Google's stable-channel update documented at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html; most installations will receive this automatically on browser restart, so users should fully close and relaunch Chrome to ensure the new binary is loaded. As compensating controls until patching completes, restrict browsing to trusted sites via enterprise policy (URLBlocklist/URLAllowlist), enforce Site Isolation (already default but verify chrome://flags), and consider disabling hardware-accelerated graphics via the --disable-gpu flag or chrome://settings - note this degrades video and canvas performance and breaks WebGL-dependent applications. Organizations using Chromium-based browsers (Edge, Brave, Opera, Electron apps) should track their respective vendor advisories for the corresponding fix uptake.