What is the CVSS score of CVE-2026-10920?

CVE-2026-10920 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-10920?

Google Chrome on macOS contains a vulnerability that could allow attackers to take over employee machines if a user visits a malicious website.. A patch is available.

How to fix or mitigate CVE-2026-10920?

Within 24 hours: Identify all macOS systems running Chrome and create an inventory of current versions. Within 7 days: Distribute Chrome 149.0.7827.53 or later to all macOS endpoints through your existing patch management system. Within 30 days: Confirm that 100% of macOS systems are updated and running the patched version.

Google Chrome CVE-2026-10920

EUVD-2026-34369 HIGH

Improper Input Validation (CWE-20)

2026-06-04 chrome-cve-admin@google.com

GHSA-89p6-7q8f-m28j

Information Disclosure Google

8.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.2 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 02:37 vuln.today

CVSS changed

Jun 05, 2026 - 02:22 NVD

8.3 (HIGH)

CVE Published

Jun 04, 2026 - 23:16 nvd

HIGH 8.3

CVE Published

Jun 04, 2026 - 23:16 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient validation of untrusted input in WebShare in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome on macOS prior to 149.0.7827.53 allows a remote attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page abusing the WebShare component. The bug is rated High severity by Chromium and carries a CVSS 8.3 with scope change reflecting the sandbox boundary crossing, though no public exploit has been identified at time of analysis.

Technical ContextAI

WebShare is the Chrome implementation of the Web Share API, which exposes native sharing functionality (text, URLs, files) from web content to the host operating system's share sheet - on macOS this bridges JavaScript-originated share intents to platform IPC handlers. The flaw is classified as CWE-20 (Improper Input Validation), meaning data flowing from the lower-privileged renderer process into the higher-privileged browser/broker process via WebShare IPC messages is not adequately validated, enabling a compromised renderer to influence behavior across the sandbox boundary. Affected CPE coverage per EUVD is the google:chrome product on the apple:macos platform prior to 149.0.7827.53; Windows and Linux builds are not listed as affected by this specific issue.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 for macOS - upgrade immediately via Chrome's built-in updater (chrome://settings/help) or by redeploying the managed MSI/PKG through your endpoint management tooling, as described in the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Because the bug requires a prior renderer compromise, the highest-leverage compensating control until patching completes is enforcing Site Isolation (enabled by default in Chrome) and ensuring the Enhanced Safe Browsing policy is on to reduce the likelihood of the renderer-stage exploit landing. Enterprises can additionally disable the Web Share API exposure via the navigator.share surface using the WebShareEnabled-style site permission controls or by restricting which origins can call share-related APIs through enterprise policy, accepting the trade-off that legitimate share-sheet integrations on internal web apps will break; this should be treated as a temporary measure rather than a substitute for the version upgrade.