What is the CVSS score of CVE-2026-10919?

CVE-2026-10919 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-10919?

A high-severity sandbox escape in Google Chrome (versions before 149.0.7827.53) could escalate attacker privileges on affected systems when chained with browser vulnerabilities; no public exploit has…. A patch is available.

How to fix or mitigate CVE-2026-10919?

24 hours: Audit all Chrome installations in your organization to identify systems running versions prior to 149.0.7827.53. 7 days: Deploy Chrome 149.0.7827.53 or later to all affected endpoints via your standard patch management process. 30 days: Verify 100% compliance with the minimum required version and confirm automatic updates are enabled.

Google Chrome CVE-2026-10919

EUVD-2026-34368 HIGH

Use After Free (CWE-416)

2026-06-04 chrome-cve-admin@google.com

GHSA-hpr8-xm43-7q66

Denial Of Service Google Use After Free Memory Corruption

8.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.7 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 02:36 vuln.today

CVSS changed

Jun 05, 2026 - 02:22 NVD

8.3 (HIGH)

CVE Published

Jun 04, 2026 - 23:16 nvd

HIGH 8.3

CVE Published

Jun 04, 2026 - 23:16 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Use after free in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome's ANGLE graphics layer (versions prior to 149.0.7827.53) allows a remote attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page. The flaw is a use-after-free (CWE-416) rated High severity by Chromium and CVSS 8.3, and while no public exploit is identified at time of analysis, sandbox escapes in ANGLE have historically been chained with renderer RCE bugs to achieve full system compromise.

Technical ContextAI

ANGLE (Almost Native Graphics Layer Engine) is Chrome's translation layer that maps WebGL and other GPU API calls to the underlying platform graphics backend (Direct3D on Windows, Metal on macOS, OpenGL/Vulkan on Linux). It runs in the more-privileged GPU process, which sits outside Chrome's renderer sandbox, making ANGLE memory-corruption bugs a classic vector for sandbox escapes. CWE-416 (Use After Free) here means an object in ANGLE is referenced after being freed, allowing an attacker who can already feed crafted GPU/WebGL commands from a compromised renderer to corrupt memory in the GPU process and pivot to code execution outside the renderer sandbox.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 or later on the Stable channel - update immediately via Chrome's built-in updater (Help → About Google Chrome) or push the update through enterprise management (Chrome Browser Cloud Management, Group Policy, Jamf, Intune). Administrators of Chromium-based browsers should monitor their respective vendors for rebased builds and apply them as soon as available. As a temporary compensating control where patching is delayed, disabling hardware-accelerated graphics (chrome://settings → System → 'Use graphics acceleration when available' off, or the HardwareAccelerationModeEnabled=false enterprise policy) reduces ANGLE attack surface for WebGL/GPU paths, at the cost of degraded rendering performance and broken WebGL content; this is a partial mitigation only and is not a substitute for the patch. Refer to the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for vendor guidance.