What is the CVSS score of CVE-2026-10914?

CVE-2026-10914 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

How to fix or mitigate CVE-2026-10914?

Within 24 hours: Issue security alert about CVE-2026-10914 and audit all Chrome versions across the organization. Within 7 days: Deploy Google Chrome version 149.0.7827.53 or later to all Windows systems using managed update mechanisms or manual deployment. Within 30 days: Conduct compliance audit to verify 100% patch deployment and remediate any systems still running vulnerable versions.

Google Chrome CVE-2026-10914

Q: Which versions of Google Chrome are affected by CVE-2026-10914?

A significant vulnerability in Google Chrome for Windows (prior to version 149.0.7827.53) allows attackers to execute arbitrary code on user systems through malicious websites.. A patch is available.

EUVD-2026-34363 HIGH

Use After Free (CWE-416)

2026-06-04 chrome-cve-admin@google.com

GHSA-rq3r-cqg6-qmg3

RCE Denial Of Service Google Use After Free Memory Corruption Microsoft

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 02:34 vuln.today

CVSS changed

Jun 05, 2026 - 02:22 NVD

8.8 (HIGH)

CVE Published

Jun 04, 2026 - 23:16 nvd

HIGH 8.8

CVE Published

Jun 04, 2026 - 23:16 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Use after free in ANGLE in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome's ANGLE graphics layer on Windows prior to version 149.0.7827.53 allows attackers to execute arbitrary code inside the renderer sandbox when a victim visits a crafted HTML page. The flaw is a use-after-free (CWE-416) memory corruption issue rated High severity by Chromium, requires user interaction to trigger, and no public exploit has been identified at time of analysis.

Technical ContextAI

ANGLE (Almost Native Graphics Layer Engine) is the translation layer Chrome uses on Windows to convert OpenGL ES API calls (used by WebGL, Canvas, and other GPU-accelerated web features) into Direct3D calls supported by the underlying Windows graphics stack. A use-after-free vulnerability (CWE-416) occurs when memory is dereferenced after being freed, allowing an attacker who controls subsequent allocations to corrupt object state or hijack control flow. Because ANGLE processes attacker-influenced graphics commands from web content, a malicious HTML page can stage allocations to manipulate the freed object and achieve code execution within the constrained renderer process.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 for Windows resolves the issue, so administrators should ensure auto-update is enabled and force a relaunch to apply the fix, as documented in the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Chromium-derived browsers (Edge, Brave, Opera, Vivaldi) should be updated once their respective vendors integrate the ANGLE fix. Where immediate patching is not feasible, compensating controls include disabling hardware-accelerated graphics via the chrome://flags 'Override software rendering list' set to Disabled or the --disable-gpu launch flag to bypass ANGLE entirely (trade-off: degraded WebGL/Canvas performance and broken GPU-dependent web apps), and restricting browsing to trusted sites via enterprise URL allowlisting (trade-off: significant usability impact). Enterprise admins should also verify the ChromeVariationsRestrictMode and component update policies are not blocking the patched build from rolling out.