What is the CVSS score of CVE-2026-10904?

CVE-2026-10904 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-10904?

Google Chrome users face a high-severity remote code execution vulnerability that could compromise organizational systems and data through simple social engineering.. A patch is available.

How to fix or mitigate CVE-2026-10904?

Within 24 hours: Identify Chrome deployment scope and communicate patch urgency to IT and end users. Within 7 days: Deploy Google Chrome version 149.0.7827.53 or later across all affected systems. Within 30 days: Verify complete patch deployment and monitor for exploitation attempts.

Google Chrome CVE-2026-10904

EUVD-2026-34353 HIGH

Improper Input Validation (CWE-20)

2026-06-04 chrome-cve-admin@google.com

GHSA-rrj4-pc9w-444f

RCE Google

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 13:22 vuln.today

CVSS changed

Jun 05, 2026 - 13:22 NVD

8.8 (HIGH)

CVE Published

Jun 04, 2026 - 23:16 nvd

HIGH 8.8

CVE Published

Jun 04, 2026 - 23:16 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome's V8 JavaScript engine prior to version 149.0.7827.53 allows a remote attacker to execute arbitrary code within the browser sandbox by luring a user to a crafted HTML page. Rated High severity by Chromium with a CVSS 8.8, the flaw requires user interaction (visiting a malicious site) but no authentication or privileges. No public exploit has been identified at the time of analysis, and the issue is not currently listed in CISA KEV.

Technical ContextAI

The vulnerability resides in V8, the open-source JavaScript and WebAssembly engine that powers Chrome and Chromium-derived browsers (Edge, Opera, Brave, Electron apps). It is classified under CWE-20 (Improper Input Validation), described by Google as an 'inappropriate implementation' bug - typically a logic flaw in the engine's handling of language semantics, optimizations, or runtime checks rather than a classic memory-corruption issue. Successful exploitation yields arbitrary code execution constrained to Chrome's renderer sandbox, meaning a second sandbox-escape bug would be needed to fully compromise the host.

RemediationAI

Vendor-released patch: update Google Chrome to 149.0.7827.53 or later via the stable-channel update referenced at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html; in managed environments, push the update through enterprise channels (Chrome Browser Cloud Management, MSI/MDM, or auto-update policies) and confirm with chrome://settings/help. Track upstream Chromium issue https://issues.chromium.org/issues/506855825 for technical detail once unrestricted. For Chromium derivatives, apply the vendor's corresponding update (Edge, Brave, Opera, etc.) and rebuild any Electron/CEF applications against a patched runtime. If immediate patching is not possible, compensating controls include disabling JavaScript on untrusted origins via enterprise policy (DefaultJavaScriptSetting=2 with allowlists - breaks most modern web apps), enforcing Site Isolation and the strictest sandboxing flags (already default but verify), and using web filtering or DNS controls to block known malicious domains; these are partial mitigations only and degrade browsing functionality.