What is the CVSS score of CVE-2026-10927?

CVE-2026-10927 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-10927?

Google Chrome versions prior to 149.0.7827.53 contain a high-severity sandbox escape vulnerability (CVSS 8.3) that could allow attackers to gain system-level access and compromise enterprise data.. A patch is available.

How to fix or mitigate CVE-2026-10927?

Within 24 hours: Assess Chrome deployment across the organization and identify all systems running versions prior to 149.0.7827.53. Within 7 days: Deploy Chrome 149.0.7827.53 or later enterprise-wide using your endpoint management system, prioritizing systems with administrative privileges and those handling sensitive data. Within 30 days: Verify 100% patch compliance and review Chrome auto-update policies to ensure timely future updates.

Google Chrome CVE-2026-10927

EUVD-2026-34376 HIGH

Out-of-bounds Read (CWE-125)

2026-06-04 chrome-cve-admin@google.com

GHSA-w2x6-xcgf-jr36

Information Disclosure Google Buffer Overflow Red Hat Suse Chrome

8.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.7 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 02:40 vuln.today

CVSS changed

Jun 05, 2026 - 02:22 NVD

8.3 (HIGH)

CVE Published

Jun 04, 2026 - 23:16 nvd

HIGH 8.3

CVE Published

Jun 04, 2026 - 23:16 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Out of bounds read in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome versions prior to 149.0.7827.53 can be achieved by remote attackers who have already compromised the renderer process, leveraging an out-of-bounds read in the Dawn WebGPU implementation via a crafted HTML page. Google rates this as High severity and a vendor patch is available, though no public exploit has been identified at time of analysis. The bug is part of a multi-stage exploitation chain rather than a single-step RCE, but successful chaining yields full escape from Chrome's renderer sandbox.

Technical ContextAI

Dawn is Chromium's cross-platform implementation of the WebGPU standard, providing GPU access to web content through a unified abstraction over Direct3D, Metal, and Vulkan backends. The vulnerability is classified as CWE-125 (Out-of-bounds Read), a memory safety class where the code reads beyond the bounds of an allocated buffer, which in the context of a GPU command/buffer handler can leak adjacent memory contents or corrupt control-flow data used by the GPU process. Because Dawn code historically runs in the more-privileged GPU process boundary, an OOB read triggered from renderer-supplied WebGPU commands can be abused to disclose pointers or state needed to defeat sandbox isolation, enabling escape from the renderer sandbox into a higher-privilege context.

RemediationAI

Apply the vendor-released patch by upgrading Google Chrome to 149.0.7827.53 or later via the Stable channel update documented at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html and tracked under https://issues.chromium.org/issues/500090141; managed environments should force-restart Chrome to ensure the new binary loads. For Chromium-based browsers, install the corresponding vendor update once available. As a temporary compensating control where patching is delayed, disable WebGPU via the chrome://flags/#enable-unsafe-webgpu setting or the WebGPU enterprise policy, which removes the Dawn attack surface at the cost of breaking WebGPU-dependent sites and applications; restricting use of untrusted web content and enabling Site Isolation (default) further limits the value of a renderer compromise needed to reach this bug.