What is the CVSS score of CVE-2026-10895?

CVE-2026-10895 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-10895?

Google Chrome versions prior to 149.0.7827.53 contain a remote code execution vulnerability affecting all desktop deployments.. A patch is available.

How to fix or mitigate CVE-2026-10895?

Within 24 hours: Notify IT/endpoint management teams and prepare patch deployment strategy for Chrome 149.0.7827.53 or later. Within 7 days: Deploy patch to at least 80% of managed Chrome installations, prioritizing high-value user groups and administrative accounts. Within 30 days: Achieve 95% or greater compliance across all Chrome-using endpoints; implement browser update policies to enforce automatic patching for future releases.

Google Chrome CVE-2026-10895

EUVD-2026-34344 HIGH

Use After Free (CWE-416)

2026-06-04 chrome-cve-admin@google.com

GHSA-72hc-c42c-v857

Google Memory Corruption RCE Use After Free Denial Of Service Red Hat Suse Chrome

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 02:26 vuln.today

CVSS changed

Jun 05, 2026 - 02:22 NVD

8.8 (None) 8.8 (HIGH)

CVE Published

Jun 04, 2026 - 23:16 nvd

HIGH 8.8

CVE Published

Jun 04, 2026 - 23:16 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Use after free in Ozone in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)

AnalysisAI

Remote code execution in Google Chrome's Ozone display server layer affects all desktop versions prior to 149.0.7827.53, where a use-after-free memory corruption flaw can be triggered by a crafted HTML page. Chromium-internal severity is rated Critical and the CVSS 3.1 score of 8.8 reflects high impact across confidentiality, integrity, and availability, though exploitation requires user interaction (visiting an attacker-controlled page). No public exploit has been identified at time of analysis, and CISA SSVC currently lists Exploitation as 'none'.

Technical ContextAI

Ozone is Chromium's platform abstraction layer for windowing, display, and input handling - it brokers between the browser's rendering pipeline and the underlying OS graphics stack (X11, Wayland, Aura, etc.). CWE-416 (use-after-free) in this component means the renderer or browser process retains and dereferences a pointer to memory that has already been freed, an exploit primitive that historically yields reliable type confusion and read/write gadgets when combined with a heap-grooming JavaScript payload. Because Ozone touches OS-level graphics handles, successful exploitation against a sandboxed renderer can also serve as a stepping stone toward sandbox escape, which aligns with the Critical Chromium severity rating despite the network-vector CVSS being capped at 8.8 by the UI:R requirement.

RemediationAI

Vendor-released patch: Chrome 149.0.7827.53 - update to this version or later via the Chrome Stable Channel as described at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html, and in managed environments use Chrome Browser Cloud Management or your endpoint manager to force-relaunch browsers to apply the update. Until the patched build is deployed, the most effective compensating control is restricting users from browsing untrusted sites via enterprise web filtering or proxy policy (trade-off: degrades general browsing utility); disabling JavaScript on untrusted origins via Chrome policy (DefaultJavaScriptSetting=2 with explicit allowlist) makes exploiting a renderer-side UAF substantially harder but breaks most modern web applications. Site Isolation and the renderer sandbox are already enabled by default and reduce post-exploitation impact, but do not prevent the initial RCE in the renderer process. Chromium-derivative browsers (Edge, Brave, Opera, Vivaldi) should be updated as soon as their upstream rebases land.