What is the CVSS score of CVE-2026-10906?

CVE-2026-10906 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-10906?

Google Chrome versions prior to 149.0.7827.53 contain a heap corruption vulnerability in the WebAuthentication component that allows remote code execution through a crafted webpage combined with user…. A patch is available.

How to fix or mitigate CVE-2026-10906?

Within 24 hours: Update all Google Chrome instances to version 149.0.7827.53 or later via managed deployment or auto-update. Within 7 days: Audit organizational systems to verify 100% patching compliance and confirm Chrome auto-update is enabled organization-wide. Within 30 days: Review endpoint patch management policies to reduce exposure window for critical severity vulnerabilities.

Google Chrome CVE-2026-10906

EUVD-2026-34355 HIGH

Use After Free (CWE-416)

2026-06-04 chrome-cve-admin@google.com

GHSA-2f46-p5x2-58vv

Denial Of Service Use After Free Memory Corruption Google Red Hat Suse Chrome

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 02:30 vuln.today

CVSS changed

Jun 05, 2026 - 02:22 NVD

7.5 (HIGH)

CVE Published

Jun 04, 2026 - 23:16 nvd

HIGH 7.5

CVE Published

Jun 04, 2026 - 23:16 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Use after free in WebAuthentication in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Heap corruption in Google Chrome's WebAuthentication component prior to version 149.0.7827.53 allows remote attackers to potentially execute arbitrary code through a crafted HTML page combined with user interaction. The flaw is a use-after-free (CWE-416) rated High severity by Chromium and carries a CVSS 7.5 score, though exploitation requires specific UI gestures from the victim. No public exploit identified at time of analysis, and the vulnerability is not currently listed in CISA KEV.

Technical ContextAI

The vulnerability resides in Chrome's WebAuthentication implementation, the browser-side component that powers the W3C Web Authentication API (WebAuthn) used for passwordless authentication, hardware security keys, and platform authenticators. CWE-416 (Use After Free) indicates that the code continues to reference heap memory after it has been freed - when an attacker can influence what data occupies that reclaimed memory region, they can corrupt the heap state, potentially achieving arbitrary code execution within Chrome's renderer or browser process sandbox. WebAuthn handlers are particularly attractive targets because they bridge web content with native credential APIs and often involve complex asynchronous state machines tied to UI prompts, which is consistent with the 'specific UI gestures' trigger noted in the advisory.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 or later on the Stable channel - update immediately via Chrome's built-in updater or by redeploying managed installations, and confirm rollout via the advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Administrators of Chromium-based browsers should track their vendor's release notes for the equivalent merge. If patching must be delayed, compensating controls include disabling the WebAuthentication API via enterprise policy (WebAuthenticationRemoteDesktopSupportEnabled and related WebAuthn policies) for high-risk user populations - this trade-off breaks passwordless login flows and hardware-key authentication for the affected users. Restricting browsing to allowlisted internal sites via SafeSites or proxy filtering reduces exposure to attacker-controlled HTML at the cost of breaking general web usage.