What is the CVSS score of CVE-2026-10900?

CVE-2026-10900 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-10900?

Google Chrome on macOS versions prior to 149.0.7827.53 contains a critical memory corruption vulnerability in the password component that could allow attackers to compromise stored credentials if…. A patch is available.

How to fix or mitigate CVE-2026-10900?

Within 24 hours: Inventory macOS systems running Google Chrome and identify those with versions prior to 149.0.7827.53. Within 7 days: Deploy Chrome 149.0.7827.53 or later to all affected macOS systems using your software deployment tool. Within 30 days: Confirm 100% patch deployment and retire older Chrome versions from supported endpoints.

Google Chrome CVE-2026-10900

EUVD-2026-34349 HIGH

Use After Free (CWE-416)

2026-06-04 chrome-cve-admin@google.com

GHSA-q79v-g93v-qghq

Denial Of Service Use After Free Memory Corruption Google Red Hat Suse Chrome

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 02:28 vuln.today

CVSS changed

Jun 05, 2026 - 02:22 NVD

7.5 (HIGH)

CVE Published

Jun 04, 2026 - 23:16 nvd

HIGH 7.5

CVE Published

Jun 04, 2026 - 23:16 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Use after free in Passwords in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)

AnalysisAI

Remote heap corruption in Google Chrome on macOS prior to 149.0.7827.53 stems from a use-after-free in the Passwords component, letting a remote attacker who lures a user into specific UI interactions trigger memory corruption via a crafted HTML page. Chromium rates the underlying flaw Critical and a vendor patch is available, though no public exploit has been identified at time of analysis and active exploitation has not been confirmed by CISA KEV.

Technical ContextAI

The defect is a CWE-416 use-after-free in Chrome's Passwords subsystem (the browser-side password manager UI/storage flow) on the macOS build of the Chromium-based browser identified by CPE strings tied to Google Chrome 149.x. Use-after-free occurs when code dereferences a heap object after it has been freed, allowing an attacker who can groom the heap (typical via JavaScript allocations in a crafted page) to reuse the freed slot with attacker-controlled data and corrupt object metadata or vtables. In Chrome, such bugs in renderer-adjacent components can lead to type confusion and arbitrary read/write in the affected process, and when combined with the right UI gesture path through the Passwords feature, the freed object is reachable from web content.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 for macOS - upgrade all macOS endpoints to this version or later via the Chrome stable channel as documented at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html, and force-restart browsers so the new binary is loaded. If immediate patching is blocked, compensating controls include disabling Chrome's built-in password manager (chrome://settings 'Offer to save passwords' off, and 'Auto Sign-in' off) to reduce reachability of the vulnerable Passwords code paths - trade-off is loss of autofill for users who rely on it; enforcing a managed policy that blocks untrusted sites via SafeSites/URL allowlisting reduces the chance a user lands on a crafted page but does not eliminate the bug; and advising users not to interact with unexpected password prompts on untrusted sites reduces the UI-gesture trigger but is not a reliable control. Re-enable defaults once the fixed build is deployed.