What is the CVSS score of CVE-2026-10909?

CVE-2026-10909 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-10909?

Google Chrome versions prior to 149.0.7827.53 contain a sandbox escape vulnerability that allows attackers who have compromised the renderer process to escalate to full system access via a…. A patch is available.

How to fix or mitigate CVE-2026-10909?

Within 24 hours: Audit Chrome version deployment across endpoints and identify systems below 149.0.7827.53. Within 7 days: Deploy Chrome 149.0.7827.53 or later to all endpoints via MDM or auto-update mechanisms. Within 30 days: Verify patch application across the estate and review browser vulnerability detection tooling to catch upstream renderer compromises.

Google Chrome CVE-2026-10909

EUVD-2026-34358 HIGH

Use After Free (CWE-416)

2026-06-04 chrome-cve-admin@google.com

GHSA-2xvj-w2h2-c44m

Denial Of Service Google Use After Free Memory Corruption

8.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.0 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 02:32 vuln.today

CVSS changed

Jun 05, 2026 - 02:22 NVD

8.3 (HIGH)

CVE Published

Jun 04, 2026 - 23:16 nvd

HIGH 8.3

CVE Published

Jun 04, 2026 - 23:16 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Use after free in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome versions prior to 149.0.7827.53 enables a remote attacker who has already compromised the renderer process to break out of the browser sandbox via a use-after-free flaw in the Dawn WebGPU implementation. Exploitation requires luring a victim to a crafted HTML page and chaining this bug with a prior renderer compromise, but the impact is full sandbox escape with high confidentiality, integrity, and availability consequences. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.

Technical ContextAI

Dawn is Chromium's cross-platform implementation of the WebGPU standard, providing a hardware-accelerated graphics and compute API to web content; it runs partially in the GPU process and exposes a complex IPC and resource-lifetime surface to renderer-supplied commands. The root cause is CWE-416 (Use After Free), a memory-safety class in which an object is freed while a dangling reference remains, allowing an attacker who controls subsequent heap state to reuse the freed slot and steer execution or corrupt sensitive structures. In Chrome's multi-process architecture, a Dawn UAF reachable from a compromised renderer is particularly impactful because the GPU process sits across a privilege boundary that the renderer sandbox is designed to enforce, making such bugs a classic component of full-chain Chrome exploits.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 or later on the stable desktop channel - update immediately via Chrome's built-in updater or by redeploying managed Chrome installers, and verify rollout per the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Downstream Chromium browsers (Edge, Brave, Opera, Vivaldi) and Electron-based applications should be updated to the build that incorporates the fixed Dawn version once each vendor releases it. As a compensating control until patching completes, administrators can disable WebGPU by setting the enterprise policy or chrome://flags entry that turns off WebGPU/Dawn, which removes the vulnerable attack surface at the cost of breaking sites that rely on GPU compute or graphics features; site-isolation and strict-renderer-sandbox enterprise policies should remain enabled, and high-risk users can be moved to per-tab process isolation or alternative browsers with WebGPU disabled during the patch window.