What is the CVSS score of CVE-2026-10903?

CVE-2026-10903 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-10903?

Google Chrome versions prior to 149.0.7827.53 contain a remote code execution vulnerability in the WebRTC component that allows attackers to execute arbitrary code within the renderer sandbox by…. A patch is available.

How to fix or mitigate CVE-2026-10903?

Within 24 hours: Deploy Chrome 149.0.7827.53 or later across all systems using automated update policies (GPO/MDM). Within 7 days: Verify patch deployment across 100% of Chrome installations and block pre-149.0.7827.53 versions at network enforcement points where feasible. Within 30 days: Audit Chrome version compliance, document deployment completion, and implement continuous monitoring for exploitation attempts.

Google Chrome CVE-2026-10903

EUVD-2026-34352 HIGH

Use After Free (CWE-416)

2026-06-04 chrome-cve-admin@google.com

GHSA-vpcx-g375-gcm7

RCE Denial Of Service Google Use After Free Memory Corruption

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 02:29 vuln.today

CVSS changed

Jun 05, 2026 - 02:22 NVD

8.8 (None) 8.8 (HIGH)

CVE Published

Jun 04, 2026 - 23:16 nvd

HIGH 8.8

CVE Published

Jun 04, 2026 - 23:16 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Use after free in WebRTC in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome versions prior to 149.0.7827.53 stems from a use-after-free flaw in the WebRTC component that lets a remote attacker run arbitrary code within the renderer sandbox by luring a victim to a crafted HTML page. Google rates the underlying Chromium issue as High severity, and no public exploit is identified at time of analysis, though publicly available patch metadata and Chromium bug tracker entries (issue 503422316) confirm the fix.

Technical ContextAI

The vulnerability resides in WebRTC, the real-time communications stack built into Chromium that handles peer-to-peer audio, video, and data channels through APIs such as RTCPeerConnection and getUserMedia. The root cause is CWE-416 (Use After Free): a WebRTC object is freed while a dangling pointer remains reachable, and subsequent dereference or reallocation of that memory region - typically driven by attacker-controlled JavaScript invoking WebRTC APIs - allows the attacker to corrupt heap state and pivot to arbitrary code execution. Because WebRTC code runs in the renderer process, exploitation lands the attacker inside Chrome's sandboxed renderer; a separate sandbox escape would be required for full system compromise.

RemediationAI

The primary remediation is to upgrade to Google Chrome 149.0.7827.53 or later on the Stable desktop channel, the vendor-released patched version cited in the Chrome Releases advisory at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html and tracked in Chromium issue https://issues.chromium.org/issues/503422316. Enterprises should force-restart Chrome to apply the update since the browser only completes patching on relaunch, and administrators can verify rollout via the chrome://settings/help page or Chrome Browser Cloud Management. As a compensating control until patching completes, restrict or disable WebRTC by deploying the URLBlocklist/WebRtcAllowLegacyTLSProtocols enterprise policies or by blocking high-risk sites at the proxy; note that disabling WebRTC will break video conferencing tools such as Google Meet, Microsoft Teams web client, and Discord web, so the workaround is generally only viable for short windows or restricted user populations.