What is the CVSS score of CVE-2026-10926?

CVE-2026-10926 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-10926?

Google Chrome versions prior to 149.0.7827.53 contain a remote code execution vulnerability in the Cast media streaming component that allows network-adjacent attackers to execute arbitrary code.. A patch is available.

How to fix or mitigate CVE-2026-10926?

Within 24 hours: Inventory all Chrome deployments across organizational networks. Within 7 days: Deploy Chrome 149.0.7827.53 or later to all affected systems using automated update mechanisms. Within 30 days: Verify patch deployment across the estate and audit network segmentation controls to restrict adjacent-network attack surface.

Google Chrome CVE-2026-10926

EUVD-2026-34375 HIGH

Use After Free (CWE-416)

2026-06-04 chrome-cve-admin@google.com

GHSA-rwjq-m543-2gh5

Google Memory Corruption RCE Use After Free Denial Of Service Red Hat Suse Chrome

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 02:40 vuln.today

CVSS changed

Jun 05, 2026 - 02:22 NVD

8.8 (HIGH)

CVE Published

Jun 04, 2026 - 23:16 nvd

HIGH 8.8

CVE Published

Jun 04, 2026 - 23:16 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Use after free in Cast in Google Chrome prior to 149.0.7827.53 allowed an attacker on the local network segment to execute arbitrary code via malicious network traffic. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome versions prior to 149.0.7827.53 allows an attacker on the same local network segment (adjacent network) to execute arbitrary code by sending malicious traffic to the browser's Cast component. The flaw stems from a use-after-free memory corruption issue in the Cast feature (used for media streaming to devices like Chromecast) and is rated High severity by Chromium with a CVSS score of 8.8. No public exploit identified at time of analysis, though a vendor patch has been released.

Technical ContextAI

The vulnerability resides in Chrome's Cast subsystem, the component responsible for discovering and streaming media to Chromecast and other casting receivers over the local network (typically via mDNS/DIAL and DTLS/SRTP transports). CWE-416 (Use After Free) indicates that the Cast code retains and dereferences a pointer to memory that has already been released, which under attacker influence can be reallocated with controlled data and used to corrupt program state. Because Cast device discovery and session negotiation happen automatically on the local network segment, the vulnerable code path is reachable from any host sharing that LAN/Wi-Fi broadcast domain without any user action in the browser.

RemediationAI

Vendor-released patch: upgrade Google Chrome to 149.0.7827.53 or later on the Stable channel as announced at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html; in most enterprise deployments this happens automatically but admins should verify via chrome://settings/help and force a relaunch on managed endpoints. For users who cannot patch immediately, the practical workaround is to disable the Cast/Media Router feature via the MediaRouterEnabled=false enterprise policy (trade-off: users lose the ability to cast tabs and media to Chromecast/Google TV devices) or to ensure clients only operate on trusted network segments where adjacent attackers cannot reach the browser, since the bug requires reachability on the local broadcast domain. Blocking outbound/inbound mDNS (UDP 5353) and DIAL discovery traffic at the network edge does not help because the attack originates from inside the same segment, but VLAN/wireless client isolation does meaningfully reduce exposure.