What is the CVSS score of CVE-2026-10893?

CVE-2026-10893 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-10893?

Google Chrome Remote Desktop contains a remote code execution vulnerability (CVE-2026-10893) affecting versions prior to 149.0.7827.53 that could allow attackers to execute arbitrary code on the…. A patch is available.

How to fix or mitigate CVE-2026-10893?

Within 24 hours: Identify all systems using Chrome Remote Desktop and document current Chrome version inventory. Within 7 days: Deploy Chrome version 149.0.7827.53 or later across all affected systems through standard patch management processes. Within 30 days: Verify patch compliance across the enterprise and implement endpoint monitoring for exploitation indicators.

Google Chrome CVE-2026-10893

EUVD-2026-34342 HIGH

Use After Free (CWE-416)

2026-06-04 chrome-cve-admin@google.com

GHSA-gwmp-chcm-8m6p

RCE Denial Of Service Google Use After Free Memory Corruption

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

10.0 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 18:39 vuln.today

CVSS changed

Jun 05, 2026 - 16:22 NVD

8.8 (HIGH)

CVE Published

Jun 04, 2026 - 23:16 nvd

HIGH 8.8

CVE Published

Jun 04, 2026 - 23:16 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Use after free in Chromoting in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code via malicious network traffic. (Chromium security severity: Critical)

AnalysisAI

Remote code execution in Google Chrome versions prior to 149.0.7827.53 stems from a use-after-free flaw in the Chromoting (Chrome Remote Desktop) component, which Google rated Critical internally. A remote attacker can deliver malicious network traffic to a user with an active Chromoting session and execute arbitrary code in the browser context, though user interaction is required per the CVSS vector. No public exploit identified at time of analysis, and EPSS probability is very low (0.04%).

Technical ContextAI

The flaw resides in Chromoting, the Chrome subsystem that powers Chrome Remote Desktop and uses the WebRTC/protobuf-based protocol for screen sharing and input forwarding between hosts and clients. CWE-416 (Use After Free) means the code dereferences a heap object after it has been freed, typically because a network event handler retains a stale pointer to a session, channel, or buffer object whose lifetime is tied to a separate connection state machine. In Chromoting specifically, this class of bug is commonly triggered by out-of-order or malformed protocol messages that race object teardown, and successful exploitation typically yields arbitrary read/write in the renderer or utility process hosting the Chromoting client, which can then be chained with a sandbox escape for full RCE.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 - update via Chrome's built-in updater (chrome://settings/help) and restart the browser to apply, per the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html and the upstream tracker at https://issues.chromium.org/issues/513231432. For managed fleets, push the update through enterprise management (Chrome Browser Cloud Management, GPO, or MDM) and verify the version on endpoints. As an interim compensating control where patching is delayed, disable or uninstall the Chrome Remote Desktop host/extension and block outbound traffic to Chromoting relay endpoints (remotedesktop.google.com) at the network egress; trade-off is loss of legitimate remote-support workflows. Users of Chromium-based browsers (Edge, Brave, Opera, Vivaldi) should apply their respective vendor updates as they ship the merged fix.