What is the CVSS score of CVE-2026-10907?

CVE-2026-10907 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-10907?

Google Chrome versions prior to 149.0.7827.53 contain a memory corruption vulnerability in the graphics layer (CVSS 8.8) that enables remote code execution when users visit malicious websites.. A patch is available.

How to fix or mitigate CVE-2026-10907?

Within 24 hours: Identify all Chrome deployments and versions in use across the enterprise. Within 7 days: Deploy Chrome 149.0.7827.53 or later via your update mechanism (auto-update, MDM, or SCCM); prioritize systems with internet-facing roles and high user interaction. Within 30 days: Verify deployment coverage and confirm no systems remain below version 149.0.7827.53.

Google Chrome CVE-2026-10907

EUVD-2026-34356 HIGH

Out-of-bounds Write (CWE-787)

2026-06-04 chrome-cve-admin@google.com

GHSA-j7r9-qvx2-39rf

Google Memory Corruption Buffer Overflow Red Hat Suse Chrome

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 02:31 vuln.today

CVSS changed

Jun 05, 2026 - 02:22 NVD

8.8 (HIGH)

CVE Published

Jun 04, 2026 - 23:16 nvd

HIGH 8.8

CVE Published

Jun 04, 2026 - 23:16 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Out of bounds write in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Out-of-bounds write in the ANGLE graphics layer of Google Chrome versions prior to 149.0.7827.53 enables remote attackers to trigger heap corruption and potentially execute arbitrary code by luring a victim to a crafted HTML page. Chromium rates the severity as High and CVSS 8.8 reflects the network attack vector with required user interaction. No public exploit identified at time of analysis, though the bug class (memory corruption in a browser-exposed component) is historically a prime target for weaponization.

Technical ContextAI

ANGLE (Almost Native Graphics Layer Engine) is the translation layer Chrome uses to map WebGL and other GPU APIs onto the host platform's native graphics stack (Direct3D on Windows, Metal on macOS, OpenGL/Vulkan on Linux). The flaw maps to CWE-787 (Out-of-bounds Write), meaning the code writes past the bounds of an allocated buffer on the heap, corrupting adjacent memory structures. Because ANGLE processes attacker-controlled graphics commands sourced from web content (WebGL shaders, draw calls, texture data), a malicious page can shape heap state and trigger the write, a pattern frequently chained to code execution in the GPU process and used as a stepping stone toward sandbox escape.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 - update to this version or later via the Stable Channel release referenced at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html, and force a browser restart so the fix takes effect (Chrome stages updates but does not activate them until restart). Enterprises should push the update via group policy (Windows), MDM (macOS), or package manager (Linux) rather than relying on user-initiated updates. For Chromium-derivative browsers, track vendor advisories from Edge, Brave, Opera, etc., and update once their rebased build ships. As a temporary compensating control while patching is rolled out, disabling WebGL via the chrome://flags or enterprise policy HardwareAccelerationModeEnabled=false reduces ANGLE attack surface but breaks legitimate WebGL-dependent sites and degrades rendering performance.