What is the CVSS score of CVE-2026-10913?

CVE-2026-10913 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-10913?

Google Chrome on Windows contains a high-severity remote code execution vulnerability (CVE-2026-10913) exploitable through malicious webpages, affecting any organization using Chrome for work or…. A patch is available.

How to fix or mitigate CVE-2026-10913?

Within 24 hours: Identify all Chrome deployments on Windows and confirm current versions across the organization. Within 7 days: Deploy Chrome version 149.0.7827.53 or later through automatic updates or centralized patch management. Within 30 days: Verify 100% compliance and implement monitoring for version enforcement on all Windows endpoints.

Google Chrome CVE-2026-10913

EUVD-2026-34362 HIGH

Use After Free (CWE-416)

2026-06-04 chrome-cve-admin@google.com

GHSA-v594-jwhr-7586

Google Memory Corruption RCE Use After Free Microsoft Denial Of Service Red Hat Suse Chrome

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 02:34 vuln.today

CVSS changed

Jun 05, 2026 - 02:22 NVD

8.8 (HIGH)

CVE Published

Jun 04, 2026 - 23:16 nvd

HIGH 8.8

CVE Published

Jun 04, 2026 - 23:16 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Use after free in ANGLE in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome on Windows (versions prior to 149.0.7827.53) is possible through a use-after-free vulnerability in the ANGLE graphics translation layer, triggered when a victim visits a crafted HTML page. Successful exploitation yields arbitrary code execution constrained to the Chrome renderer sandbox, with Chromium rating the severity as High and CVSS scored at 8.8. There is no public exploit identified at time of analysis and CISA SSVC marks exploitation status as none, but the bug class (UAF in GPU translation) is historically a popular target for chained sandbox escapes.

Technical ContextAI

ANGLE (Almost Native Graphics Layer Engine) is the abstraction layer Chrome uses on Windows to translate WebGL and other OpenGL ES calls onto Direct3D, and it runs inside the GPU/renderer process. The root cause is CWE-416 (Use After Free): an object is freed while a dangling reference remains reachable, and subsequent dereference lets an attacker manipulate freed memory contents - a primitive commonly converted into type confusion or arbitrary read/write in V8/ANGLE exploit chains. Because ANGLE is reachable from any WebGL-capable HTML page, the attack surface is the browser content sandbox on the Windows platform specifically (per the description), where Direct3D is the ANGLE backend.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 for Windows - update via Chrome's built-in updater or by redeploying the MSI from enterprise channels, then relaunch the browser to load the patched binaries (Chrome will not apply the fix until restart). Refer to the Chrome Releases advisory at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html and tracker https://issues.chromium.org/issues/497450927. As an interim compensating control on unpatched fleets, disable hardware-accelerated WebGL via the chrome://flags 'Override software rendering list' set to Disabled or via the enterprise policy HardwareAccelerationModeEnabled=false to remove ANGLE from the renderer's reachable attack surface, accepting the trade-off of degraded GPU-rendered page performance and broken WebGL content. Downstream Chromium-based browsers (Edge, Brave, Opera, Vivaldi) should be updated once they ship the merged fix from their respective vendors.