What is the CVSS score of CVE-2026-10902?

CVE-2026-10902 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-10902?

Google Chrome versions before 149.0.7827.53 contain a critical use-after-free vulnerability enabling attackers to execute arbitrary code on victim machines through malicious webpages.. A patch is available.

How to fix or mitigate CVE-2026-10902?

24 hours: Audit Chrome deployment versions across all endpoints and enable automatic updates organization-wide. 7 days: Deploy Chrome version 149.0.7827.53 or later to 100% of managed devices; prioritize administrative workstations and customer-facing systems. 30 days: Verify 100% patch compliance via endpoint management tools and review browser security logs for exploitation attempts correlated with vulnerability disclosure period.

Google Chrome CVE-2026-10902

EUVD-2026-34351 HIGH

Use After Free (CWE-416)

2026-06-04 chrome-cve-admin@google.com

GHSA-gvq6-w27g-7pg6

Google Memory Corruption RCE Use After Free Denial Of Service Red Hat Suse Chrome

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 02:29 vuln.today

CVSS changed

Jun 05, 2026 - 02:22 NVD

8.8 (None) 8.8 (HIGH)

CVE Published

Jun 04, 2026 - 23:16 nvd

HIGH 8.8

CVE Published

Jun 04, 2026 - 23:16 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Use after free in Ozone in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)

AnalysisAI

Remote code execution in Google Chrome versions prior to 149.0.7827.53 stems from a use-after-free flaw in the Ozone graphics abstraction layer, rated Critical by Chromium's internal severity classification. Remote attackers can trigger arbitrary code execution within the browser's rendering context by enticing a victim to visit a crafted HTML page. There is no public exploit identified at time of analysis, and CISA SSVC scoring indicates no observed exploitation, though the technical impact is rated total.

Technical ContextAI

Ozone is Chromium's platform abstraction layer that handles low-level window system, display, and input integration across Linux, ChromeOS, and other platforms, sitting between the browser process and underlying graphics stacks like Wayland, X11, or DRM. The flaw is classified as CWE-416 (Use After Free), a memory corruption bug class where freed heap memory is dereferenced, allowing attackers who can shape allocator state via JavaScript or DOM operations to gain control of an object's vtable or function pointer and pivot to code execution. Because Ozone runs within Chrome processes that handle untrusted web content, the bug becomes reachable from the renderer, making web-served HTML a viable trigger surface.

RemediationAI

Update Google Chrome Stable to version 149.0.7827.53 or later, which is the vendor-released patch confirmed via the Chrome Releases blog at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Enterprises managing Chrome via policy should validate auto-update is enabled (ensure ChromeCleanupEnabled and update channel policies are not blocking the rollout) and force-restart browser sessions to apply the patch, since the fix is inactive until Chrome relaunches. Downstream Chromium-based browsers should be updated to versions that incorporate the same fix once their vendors ship rebases. As an interim compensating control where patching is delayed, restrict browsing to trusted sites via enterprise allowlists or deploy a content-isolation policy such as Site Isolation (already default) combined with disabling JavaScript on untrusted origins - note this breaks most modern web applications and is only viable for kiosk or constrained environments.