What is the CVSS score of CVE-2026-10894?

CVE-2026-10894 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-10894?

Google Chrome for Linux versions prior to 149.0.7827.53 contain a critical sandbox escape vulnerability (CVE-2026-10894) that converts a contained browser exploit into unrestricted system code…. A patch is available.

How to fix or mitigate CVE-2026-10894?

24 hours: Initiate emergency deployment of Chrome 149.0.7827.53 or later to all Linux endpoints; prioritize production systems and developer machines. 7 days: Verify complete deployment to 100% of Linux Chrome installations via endpoint management tools or manual version audits (chrome://version); remediate any non-compliant systems. 30 days: Audit and enforce automatic update policies in Chrome security policies to prevent recurrence of stale versions.

Google Chrome CVE-2026-10894

EUVD-2026-34343 HIGH

Use After Free (CWE-416)

2026-06-04 chrome-cve-admin@google.com

GHSA-qf6p-5r8q-xjgg

Denial Of Service Use After Free Memory Corruption Google Red Hat Suse Chrome

8.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.0 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 02:25 vuln.today

CVSS changed

Jun 05, 2026 - 02:22 NVD

8.3 (HIGH)

CVE Published

Jun 04, 2026 - 23:16 nvd

HIGH 8.3

CVE Published

Jun 04, 2026 - 23:16 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Use after free in Printing in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

AnalysisAI

Sandbox escape in Google Chrome on Linux prior to 149.0.7827.53 allows a remote attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page that triggers a use-after-free in the Printing component. Google rates the underlying Chromium issue as Critical severity, and no public exploit is identified at time of analysis. The CVSS 8.3 score reflects the chained nature of the attack and the scope change that results when sandbox boundaries are crossed.

Technical ContextAI

The bug is a CWE-416 Use-After-Free in Chrome's Printing subsystem, which handles print preview, PDF generation, and the IPC between the renderer and the privileged browser process. Use-after-free conditions occur when a freed memory object is dereferenced again, typically allowing an attacker to control the contents at that address and corrupt program state. Because Printing code runs at least partially in the higher-privileged browser process, a UAF reachable from a compromised renderer becomes a sandbox-escape primitive - the renderer sends crafted printing-related IPC messages or HTML that triggers freed-object reuse in the privileged process, bypassing the site isolation and seccomp/namespace sandbox protections that normally contain a compromised renderer on Linux.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 for Linux - update via the stable channel as described in the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Users of Chromium-based browsers on Linux should apply their vendor's corresponding update once it incorporates this fix. No vendor-supplied workaround is published; as a temporary compensating control, disable Chrome's print preview / printing-from-web functionality via enterprise policy (PrintingEnabled=false) where business-acceptable, which removes user access to print but does not fully neutralize all reachable code paths and breaks any workflow that depends on browser printing. Restricting users to non-Chromium browsers for untrusted browsing is a heavier alternative with obvious usability trade-offs.