What is the CVSS score of CVE-2026-10918?

CVE-2026-10918 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-10918?

Google Chrome (pre-version 149.0.7827.53) contains a sandbox escape vulnerability (CVE-2026-10918, CVSS 8.3) for which no public exploit has been identified at time of analysis.. A patch is available.

How to fix or mitigate CVE-2026-10918?

Within 24 hours: Inventory all Chrome installations and determine current version distribution across endpoints. Within 7 days: Deploy Chrome version 149.0.7827.53 or later across all endpoints; prioritize systems with administrative privileges and those processing sensitive data. Within 30 days: Verify 100% patch deployment, enable automatic Chrome updates, and review logs for exploitation indicators.

Google Chrome CVE-2026-10918

EUVD-2026-34367 HIGH

Use After Free (CWE-416)

2026-06-04 chrome-cve-admin@google.com

GHSA-g87f-xj4q-8qwq

Denial Of Service Google Use After Free Memory Corruption

8.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.0 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 02:36 vuln.today

CVSS changed

Jun 05, 2026 - 02:22 NVD

8.3 (HIGH)

CVE Published

Jun 04, 2026 - 23:16 nvd

HIGH 8.3

CVE Published

Jun 04, 2026 - 23:16 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Use after free in Viz in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome versions prior to 149.0.7827.53 allows a remote attacker who has already compromised the renderer process to break out of the browser sandbox via a use-after-free flaw in the Viz compositor component. Exploitation requires a crafted HTML page and victim interaction, and Google has rated the underlying Chromium security severity as High. No public exploit has been identified at time of analysis, but this class of bug is historically chained with renderer RCE bugs to achieve full browser compromise.

Technical ContextAI

Viz is Chromium's GPU and compositing service that handles display compositing, GL/Vulkan command submission, and frame production on behalf of renderer processes via Mojo IPC. A use-after-free (CWE-416) in this component means an object is freed while a dangling reference is still held and later dereferenced, allowing an attacker to influence freed memory and potentially achieve arbitrary read/write or control of execution flow in the Viz/GPU process - which runs at higher privilege than the sandboxed renderer. Because Viz sits across the renderer sandbox boundary, a memory-corruption bug there is a classic vector for sandbox escape when combined with a separate renderer compromise.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 on the Stable desktop channel - upgrade immediately per the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html and the Chromium issue tracker entry at https://issues.chromium.org/issues/498259721. For managed fleets, push the update via Group Policy / MDM and force a browser restart to ensure the new binary loads. If patching is delayed, compensating controls include enabling Chrome's Enhanced Site Isolation and disabling GPU acceleration via the --disable-gpu flag or the HardwareAccelerationModeEnabled=false enterprise policy to reduce the attack surface in Viz, with the trade-off of degraded rendering performance and broken WebGL/WebGPU content; additionally restrict browsing to trusted sites via SafeSites or a web proxy until the update is rolled out, accepting reduced user productivity.