What is the CVSS score of CVE-2026-10899?

CVE-2026-10899 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-10899?

Google Chrome on Linux versions prior to 149.0.7827.53 contain a heap corruption vulnerability that enables unauthenticated remote code execution when users interact with specially crafted websites.. A patch is available.

How to fix or mitigate CVE-2026-10899?

Within 24 hours: Deploy patch notification and identify all Chrome installations on Linux systems via endpoint management. Within 7 days: Apply Chrome version 149.0.7827.53 or later to 100% of affected Linux systems, prioritizing workstations accessing sensitive data. Within 30 days: Verify patch deployment completion across all endpoints; retire unsupported Chrome instances where alternatives exist.

Google Chrome CVE-2026-10899

EUVD-2026-34348 HIGH

Use After Free (CWE-416)

2026-06-04 chrome-cve-admin@google.com

GHSA-5vwx-fw27-cq5j

Denial Of Service Use After Free Memory Corruption Google Red Hat Suse Chrome

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

7.5 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 02:27 vuln.today

CVSS changed

Jun 05, 2026 - 02:22 NVD

7.5 (HIGH)

CVE Published

Jun 04, 2026 - 23:16 nvd

HIGH 7.5

CVE Published

Jun 04, 2026 - 23:16 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Use after free in Ozone in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)

AnalysisAI

Heap corruption in Google Chrome's Ozone display layer on Linux versions prior to 149.0.7827.53 allows remote attackers to potentially achieve code execution by enticing a user to perform specific UI gestures on a crafted HTML page. Chromium rates the underlying issue as Critical severity, and no public exploit has been identified at time of analysis. The defect is a use-after-free (CWE-416) reachable from the renderer's interaction with the Linux display abstraction.

Technical ContextAI

Ozone is Chromium's platform abstraction layer for window system and display integration, used on Linux (and Chrome OS) to bridge between the browser's graphics/UI stack and underlying backends such as X11 and Wayland. A use-after-free (CWE-416) in this component means an object is freed while a dangling pointer is still reachable, and subsequent dereference enables heap corruption - a common precursor to renderer-process arbitrary code execution that, when chained with a sandbox escape, can lead to full compromise. The affected platform is Chrome on Linux specifically, per the description; the Chromium bug tracker entry is issues.chromium.org/issues/516653777.

RemediationAI

Vendor-released patch: update Google Chrome on Linux to 149.0.7827.53 or later via the Stable channel, as announced in the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html (tracking bug https://issues.chromium.org/issues/516653777). For managed fleets, push the update through your endpoint management or distribution package channel and force a browser restart so the new binary is loaded. As a temporary compensating control before patching, restrict users from browsing untrusted sites (web filtering / proxy allowlists), disable or sandbox Linux desktop Chrome usage for high-risk users, and consider enabling stricter Site Isolation enterprise policies; note that these reduce but do not eliminate exposure since the trigger is a crafted HTML page plus a UI gesture, and aggressive web filtering will impact normal browsing productivity.