What is the CVSS score of CVE-2026-10921?

CVE-2026-10921 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-10921?

Google Chrome versions prior to 149.0.7827.53 contain a vulnerability that allows attackers to gain unauthorized access to employee systems through compromised web sessions.. A patch is available.

How to fix or mitigate CVE-2026-10921?

Within 24 hours: Identify all Chrome deployments across the organization and catalog current versions. Within 7 days: Deploy Chrome version 149.0.7827.53 or later to all endpoints using your standard patch management process. Within 30 days: Verify 100% deployment compliance, confirm older versions are disabled, and review security logs for any exploitation attempts.

Google Chrome CVE-2026-10921

EUVD-2026-34370 HIGH

External Control of Assumed-Immutable Web Parameter (CWE-472)

2026-06-04 chrome-cve-admin@google.com

GHSA-h7gm-jhf8-grrp

Buffer Overflow Google

8.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.2 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 02:38 vuln.today

CVSS changed

Jun 05, 2026 - 02:22 NVD

8.3 (HIGH)

CVE Published

Jun 04, 2026 - 23:16 nvd

HIGH 8.3

CVE Published

Jun 04, 2026 - 23:16 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Integer overflow in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome versions prior to 149.0.7827.53 is possible via an integer overflow in the Dawn WebGPU implementation, allowing a remote attacker who has already compromised the renderer process to break out of the browser sandbox using a crafted HTML page. Google rates the Chromium severity as High and a vendor patch is available; no public exploit identified at time of analysis and the issue is not currently listed in CISA KEV.

Technical ContextAI

Dawn is Chromium's open-source, cross-platform implementation of the WebGPU standard, which exposes GPU functionality to web content and bridges JavaScript/WebGPU calls to native graphics APIs (Vulkan, Metal, D3D12). The flaw is classified as CWE-472 (External Control of Assumed-Immutable Web Parameter), but the description and 'Buffer Overflow' tag indicate the root cause is an integer overflow in Dawn's handling of attacker-controlled values, where arithmetic on size or index parameters wraps around and undermines downstream bounds assumptions. Because Dawn code runs in the more privileged GPU process that the renderer talks to via IPC, mishandled values from a compromised renderer can corrupt memory across the sandbox boundary and enable a sandbox escape from the otherwise-isolated renderer.

RemediationAI

Upgrade Google Chrome to Stable channel version 149.0.7827.53 or later, which is the vendor-released patch identified in the Chrome Releases advisory (chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html); managed fleets should force-restart Chrome after auto-update to actually load the patched binaries since users frequently defer the restart. For Chromium-derivative browsers and Electron apps, apply the corresponding vendor update once published. As an interim compensating control for unpatched endpoints, disable WebGPU by setting the chrome://flags 'Unsafe WebGPU Support' flag to Disabled or pushing the 'WebGPUDeveloperFeaturesEnabled' / related enterprise policies off, which removes the Dawn attack surface at the cost of breaking WebGPU-dependent sites and applications; blocking untrusted browsing via network egress filtering or site isolation policies further limits exposure but does not eliminate the bug.