What is the CVSS score of CVE-2026-10892?

CVE-2026-10892 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-10892?

Google Chrome for Android contains a critical sandbox escape vulnerability (CVE-2026-10892, CVSS 9.6) that allows remote attackers to compromise the underlying Android device through a malicious…. A patch is available.

How to fix or mitigate CVE-2026-10892?

Within 24 hours: Assess Chrome for Android deployment across your mobile fleet and identify affected users. Within 7 days: Deploy Chrome for Android version 149.0.7827.53 or later via MDM or app store distribution to all devices. Within 30 days: Verify complete deployment and establish monitoring for exploitation attempts through endpoint and network security tools.

Google Chrome CVE-2026-10892

EUVD-2026-34555 CRITICAL

Out-of-bounds Write (CWE-787)

2026-06-04 chrome-cve-admin@google.com

GHSA-pw68-w453-7h43

Google Memory Corruption Buffer Overflow Red Hat Suse Chrome

9.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 18:32 vuln.today

CVSS changed

Jun 05, 2026 - 16:22 NVD

9.6 (CRITICAL)

CVE Published

Jun 04, 2026 - 23:16 nvd

CRITICAL 9.6

CVE Published

Jun 04, 2026 - 23:16 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Out of bounds write in GPU in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

AnalysisAI

Sandbox escape in Google Chrome for Android versions prior to 149.0.7827.53 stems from an out-of-bounds write in the GPU process that a remote attacker can trigger via a crafted HTML page. Google rates the underlying Chromium issue as Critical severity, and while a vendor patch is available, no public exploit identified at time of analysis and EPSS sits at 0.03% (11th percentile). The CVSS scope-changed vector (S:C) reflects the impact of breaking out of Chrome's sandbox to affect the broader Android OS context.

Technical ContextAI

The flaw is a CWE-787 out-of-bounds write in Chrome's GPU process, which on Android handles WebGL, WebGPU, and graphics compositing on behalf of renderer processes. The GPU process sits in a privileged position relative to the renderer sandbox, so memory corruption there is a classic stepping stone for sandbox escape - the renderer feeds attacker-controlled data across the IPC boundary, and a write past an allocated buffer in GPU code can be used to hijack control flow or corrupt adjacent objects. The affected component is Chromium's GPU stack on the Android platform specifically, as called out in both the description and the EUVD entry constraining the affected build to Chrome 149.0.7827.53.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 for Android - update via Google Play to the Stable channel build at or above this version (advisory: https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html). For managed Android fleets, push the update through MDM (Android Enterprise / Managed Google Play) and verify deployment status on devices. If patching is delayed, compensating controls include restricting browsing to trusted sites via enterprise URL allowlists (trade-off: breaks general web use), disabling hardware acceleration in chrome://flags to reduce GPU-process attack surface (trade-off: significant performance hit on video, WebGL, and scrolling), or steering users to an already-patched browser on the device until the rollout completes. Chromium tracker for follow-up details: https://issues.chromium.org/issues/513165325.