What is the CVSS score of CVE-2026-10901?

CVE-2026-10901 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-10901?

Google Chrome for macOS versions prior to 149.0.7827.53 contains a use-after-free vulnerability in the Passwords component enabling remote code execution; no public exploit has been identified at…. A patch is available.

How to fix or mitigate CVE-2026-10901?

Within 24 hours: Notify all macOS users to apply Chrome update to version 149.0.7827.53 or later and enable automatic updates. Within 7 days: Verify patch deployment across macOS endpoints using endpoint management tools and review security logs for exploitation attempts. Within 30 days: Conduct security awareness training on malicious web content risks, complete remediation validation, and document final patching status.

Google Chrome CVE-2026-10901

EUVD-2026-34350 HIGH

Use After Free (CWE-416)

2026-06-04 chrome-cve-admin@google.com

GHSA-qv39-c232-842j

RCE Denial Of Service Google Use After Free Memory Corruption

7.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 02:28 vuln.today

CVSS changed

Jun 05, 2026 - 02:22 NVD

7.5 (None) 7.5 (HIGH)

CVE Published

Jun 04, 2026 - 23:16 nvd

HIGH 7.5

CVE Published

Jun 04, 2026 - 23:16 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Use after free in Passwords in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)

AnalysisAI

Remote code execution in Google Chrome on macOS prior to version 149.0.7827.53 stems from a use-after-free condition in the Passwords component, allowing a remote attacker to execute arbitrary code if a victim is convinced to perform specific UI gestures on a crafted HTML page. Chromium rates the underlying severity as Critical, though CVSS scores it 7.5 due to high attack complexity and required user interaction. There is no public exploit identified at time of analysis and SSVC indicates exploitation status is none.

Technical ContextAI

The vulnerability is a CWE-416 use-after-free in the Passwords subsystem of Chromium's macOS browser build, identified by CPE-equivalent affected product Google Chrome on Mac. Use-after-free flaws occur when memory is referenced after being freed, allowing an attacker who controls the reallocated memory contents to corrupt object state and ultimately hijack execution flow. In modern browsers, such bugs in renderer-adjacent components like password management can be chained with sandbox escapes or leveraged directly when UI gestures cause specific object lifecycle transitions in the Passwords UI/data path, which is why Chromium classifies the issue as Critical despite the CVSS attack-complexity penalty.

RemediationAI

Upgrade Google Chrome on macOS to version 149.0.7827.53 or later - vendor-released patch confirmed per the Chrome Releases stable channel update at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Chrome's auto-update mechanism will deliver this to most endpoints, but enterprise fleets using managed update channels should force a relaunch to apply the fix and verify version via chrome://settings/help. As a compensating control until patching completes, administrators can disable Chrome's built-in password manager via the PasswordManagerEnabled enterprise policy (trade-off: users lose autofill and saved credentials access, potentially driving them to insecure alternatives), or restrict browsing to trusted sites via SafeBrowsingProtectionLevel enforcement to reduce exposure to crafted HTML pages.