What is the CVSS score of CVE-2026-10910?

CVE-2026-10910 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-10910?

Google Chrome versions prior to 149.0.7827.53 contain a remote code execution vulnerability in the JavaScript engine triggered when users visit malicious or compromised websites.. A patch is available.

How to fix or mitigate CVE-2026-10910?

Within 24 hours: Identify all Chrome installations and affected user counts across the organization. Within 7 days: Deploy Chrome version 149.0.7827.53 or later to all endpoints through your patch management process, prioritizing administrative users and high-value targets. Within 30 days: Verify complete patch deployment through automated compliance scanning and establish monitoring for exploitation attempts.

Google Chrome CVE-2026-10910

EUVD-2026-34359 HIGH

Access of Resource Using Incompatible Type (Type Confusion) (CWE-843)

2026-06-04 chrome-cve-admin@google.com

GHSA-mh9g-8cmw-mv9m

RCE Google Memory Corruption

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 02:33 vuln.today

CVSS changed

Jun 05, 2026 - 02:22 NVD

8.8 (HIGH)

CVE Published

Jun 04, 2026 - 23:16 nvd

HIGH 8.8

CVE Published

Jun 04, 2026 - 23:16 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Type Confusion in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome's V8 JavaScript engine prior to version 149.0.7827.53 allows a remote attacker to execute arbitrary code inside the renderer sandbox via a crafted HTML page. The flaw is a type confusion bug (CWE-843) rated High severity by Chromium with a CVSS 8.8 score; no public exploit identified at time of analysis and the vulnerability is not currently listed in CISA KEV. User interaction is required, as the victim must visit attacker-controlled or compromised content.

Technical ContextAI

V8 is Google's open-source JavaScript and WebAssembly engine that compiles and executes script content in Chrome and Chromium-derived browsers. CWE-843 (Access of Resource Using Incompatible Type) describes a class of bug where the engine treats a memory object as one type while it actually holds another, typically arising from V8's speculative optimizations or inline cache type assumptions being violated. Exploiting type confusion in V8 commonly yields an addrOf/fakeObj primitive leading to arbitrary read/write in the renderer process address space and ultimately code execution inside Chrome's renderer sandbox, as confirmed by the description. The affected component is the V8 engine bundled with Chrome desktop builds before 149.0.7827.53.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 - upgrade Chrome to 149.0.7827.53 or later via the stable channel update documented at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html and restart the browser to apply the fix. Administrators managing enterprise fleets should push the update via Google Update / MDM and verify version compliance. Downstream Chromium-based browsers (Edge, Brave, Opera, Electron apps) should be updated to versions that integrate V8 from Chrome 149.0.7827.53 or later as their vendors release them. As compensating controls until patching completes, restrict browsing to trusted sites via proxy allow-listing, disable JIT in V8 using the --js-flags="--jitless" launch flag or enterprise policy (trade-off: significant JavaScript performance degradation on legitimate sites), and enable Site Isolation and Enhanced Safe Browsing if not already on; further details on the underlying issue are tracked at https://issues.chromium.org/issues/508811477.