What is the CVSS score of CVE-2026-10896?

CVE-2026-10896 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-10896?

Google Chrome for iOS users face a critical remote code execution risk through malicious web pages, potentially allowing attackers to access corporate data and steal credentials from employee…. A patch is available.

How to fix or mitigate CVE-2026-10896?

24 hours: Issue urgent security alert to all users and IT teams regarding Google Chrome for iOS CVE-2026-10896; verify mobile device management (MDM) deployment capabilities. 7 days: Deploy Google Chrome for iOS version 149.0.7827.53 or later to all managed iOS devices; distribute advisory for BYOD users to manually update. 30 days: Confirm 95%+ deployment completion across managed fleet; implement MDM policies to enforce minimum Chrome version 149.0.7827.53 or newer.

Google Chrome CVE-2026-10896

EUVD-2026-34345 HIGH

Use After Free (CWE-416)

2026-06-04 chrome-cve-admin@google.com

GHSA-5g72-3h75-mgv2

RCE Denial Of Service Google Use After Free Memory Corruption Apple

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 02:26 vuln.today

CVSS changed

Jun 05, 2026 - 02:22 NVD

8.8 (None) 8.8 (HIGH)

CVE Published

Jun 04, 2026 - 23:16 nvd

HIGH 8.8

CVE Published

Jun 04, 2026 - 23:16 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Use after free in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)

AnalysisAI

Remote code execution in Google Chrome for iOS prior to version 149.0.7827.53 allows a remote attacker to execute arbitrary code by enticing a user to visit a crafted HTML page. Chromium rates the underlying use-after-free as Critical severity, though SSVC currently shows no observed exploitation and no public exploit identified at time of analysis. The CVSS 8.8 rating reflects high impact across confidentiality, integrity, and availability, tempered by a required user interaction (visiting the malicious page).

Technical ContextAI

The flaw is a CWE-416 use-after-free in Chrome for iOS, the WebKit-backed iOS build of Google's Chrome browser. Use-after-free bugs occur when memory is freed but a dangling pointer is subsequently dereferenced, allowing an attacker to manipulate the freed allocation (heap grooming) and hijack control flow or corrupt object state. On iOS, Chrome is required by Apple platform policy to use the system WebKit engine rather than Blink, so the affected component is likely in Chrome's iOS-specific UI/integration layer or the embedded WebKit interaction rather than Blink/V8 itself. Chromium's internal tracker entry (issues.chromium.org/513514692) is referenced but not publicly disclosed in detail.

RemediationAI

Upgrade Chrome for iOS to version 149.0.7827.53 or later - this is the vendor-released patch confirmed by Google's Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html and the NVD/EUVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-10896. On managed iOS fleets, push the update via MDM (Intune, Jamf, Workspace ONE) and verify installed version via device inventory. As a compensating control until patching completes, restrict use of Chrome on iOS in favor of Safari (which uses the same underlying WebKit but is not affected by this Chrome-specific issue), or apply web content filtering at the network edge to block untrusted HTML sources - trade-off is user friction and incomplete coverage on cellular/off-network devices. User awareness guidance to avoid untrusted links is a partial mitigation only, given UI:R is satisfied by simple page visits.