What is the CVSS score of CVE-2026-10897?

CVE-2026-10897 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-10897?

Google Chrome versions below 149.0.7827.53 contain a sandbox escape vulnerability enabling remote code execution when users visit compromised websites, directly exposing employee workstations and…. A patch is available.

How to fix or mitigate CVE-2026-10897?

Within 24 hours: Identify all Chrome deployments across the organization, enable auto-update functionality, and notify users of the critical patch requirement. Within 7 days: Deploy Chrome version 149.0.7827.53 or later across all user systems through your patch management system or confirm auto-update completion. Within 30 days: Verify 100% deployment success and document compliance in your patch management records.

Google Chrome CVE-2026-10897

EUVD-2026-34346 HIGH

Out-of-bounds Write (CWE-787)

2026-06-04 chrome-cve-admin@google.com

GHSA-vgfx-3p75-wqcx

Buffer Overflow Google Memory Corruption

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 18:38 vuln.today

CVSS changed

Jun 05, 2026 - 16:22 NVD

8.8 (HIGH)

CVE Published

Jun 04, 2026 - 23:16 nvd

HIGH 8.8

CVE Published

Jun 04, 2026 - 23:16 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in GPU in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

AnalysisAI

Sandbox escape in Google Chrome's GPU component prior to version 149.0.7827.53 allows remote attackers to break out of the renderer sandbox via a crafted HTML page when a user visits a malicious site. Google's Chromium team rated the underlying issue Critical severity, and while a patch is available, no public exploit identified at time of analysis and EPSS estimates exploitation probability at only 0.03%.

Technical ContextAI

The flaw resides in Chrome's GPU process, which handles hardware-accelerated rendering, WebGL, WebGPU, and compositing on behalf of sandboxed renderer processes. The CWE-787 classification (out-of-bounds write) combined with the 'Buffer Overflow, Memory Corruption' tags indicates the 'inappropriate implementation' is a memory-safety defect in GPU command handling - a historically high-value target because the GPU process runs with broader privileges than the renderer sandbox, making it a common pivot for sandbox escapes. Affected builds are Chrome desktop prior to 149.0.7827.53 across the Stable channel.

RemediationAI

Vendor-released patch: Chrome 149.0.7827.53 - update all desktop Chrome installations to 149.0.7827.53 or later via the Stable channel update described at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html, and ensure managed fleets force a browser relaunch so the new binary is actually loaded. Embedders and Chromium-derived browsers (Edge, Brave, Opera, Vivaldi, Electron) should pick up the corresponding upstream fix from their vendors once published. If patching must be delayed, compensating controls include disabling hardware acceleration in chrome://settings (which reduces the GPU process attack surface but degrades video, WebGL, and WebGPU performance and breaks some sites), enforcing Site Isolation and restricting WebGL/WebGPU via enterprise policy (HardwareAccelerationModeEnabled=false, WebGLEnabled=false), and blocking untrusted browsing through proxy-level URL filtering - each trades user experience or productivity for reduced exposure.