What is the CVSS score of CVE-2026-10924?

CVE-2026-10924 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-10924?

Google Chrome versions prior to 149.0.7827.53 contain a high-severity sandbox escape vulnerability in the Chromecast component.. A patch is available.

How to fix or mitigate CVE-2026-10924?

Within 24 hours: Inventory all Chrome installations and identify systems running versions prior to 149.0.7827.53; assess risk exposure for each deployment context. Within 7 days: Deploy Chrome 149.0.7827.53 or later across the organization using your standard update mechanism; prioritize systems with high user interaction or external access. Within 30 days: Verify 100% patch coverage across all endpoints, enforce Chrome auto-update policies organization-wide, and log-hunt for any exploitation attempts targeting CVE-2026-10924.

Google Chrome CVE-2026-10924

EUVD-2026-34373 HIGH

External Control of Assumed-Immutable Web Parameter (CWE-472)

2026-06-04 chrome-cve-admin@google.com

GHSA-7fpx-m38w-8859

Buffer Overflow Google

8.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.7 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 02:39 vuln.today

CVSS changed

Jun 05, 2026 - 02:22 NVD

8.3 (HIGH)

CVE Published

Jun 04, 2026 - 23:16 nvd

HIGH 8.3

CVE Published

Jun 04, 2026 - 23:16 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Integer overflow in Chromecast in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome's Chromecast component prior to 149.0.7827.53 allows a remote attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page. Rated High severity by the Chromium project with a CVSS of 8.3, the flaw requires a prior renderer compromise and user interaction, and no public exploit identified at time of analysis. Successful exploitation gives attackers code execution outside the renderer's restricted context, dramatically expanding impact on the host.

Technical ContextAI

The vulnerability is an integer overflow (CWE-472, related to externally controlled data used in a critical decision, with characteristics of integer-overflow / buffer-overflow class issues per the 'Buffer Overflow' tag) within Chrome's Chromecast subsystem, which handles media casting between the browser and Chromecast receiver devices. Chromecast functionality is integrated into the browser process boundary, so a miscalculated size or length value during message handling can corrupt memory in a more privileged process than the renderer. Because Chrome enforces a multi-process sandbox model where renderer processes are tightly confined, integer overflows in privileged components like Chromecast are a classic stepping stone for sandbox escapes - they let an already-compromised renderer push a crafted payload across the IPC boundary and execute code in a less-restricted context.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 (Stable channel) - upgrade Chrome to 149.0.7827.53 or later on all desktop platforms by allowing the auto-update to complete and restarting the browser, as announced at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html and tracked under https://issues.chromium.org/issues/500055357. Enterprises managing Chrome via policy should push the update through Google Update / Chrome Browser Cloud Management and verify version compliance via chrome://settings/help. For Chromium-derived browsers, apply the equivalent vendor build once released. As an interim compensating control until patching completes, administrators can disable Chromecast / media casting via the MediaRouterCastAllowAllIPs and EnableMediaRouter enterprise policies (set EnableMediaRouter=false) to remove the vulnerable attack surface entirely; trade-off is that users lose cast-to-TV functionality. Browsing-hygiene controls (SafeBrowsing Enhanced Protection, site isolation, blocking access to untrusted sites) reduce - but do not eliminate - the chance of reaching the renderer-compromise prerequisite.