What is the CVSS score of CVE-2026-10928?

CVE-2026-10928 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-10928?

Google Chrome versions prior to 149.0.7827.53 contain a remote code execution vulnerability that allows unauthorized system access through attacker-controlled web content, affecting all employees who…. A patch is available.

How to fix or mitigate CVE-2026-10928?

Within 24 hours: Inventory Chrome deployments and determine whether automatic updates are enabled organization-wide. Within 7 days: Deploy Google Chrome 149.0.7827.53 or later via your patch management system to all endpoints; prioritize systems with administrative privileges. Within 30 days: Confirm deployment compliance via endpoint telemetry, search security logs for exploitation indicators (script execution anomalies, unexpected processes), and conduct spot-checks on high-risk systems.

Google Chrome CVE-2026-10928

EUVD-2026-34377 HIGH

Code Injection (CWE-94)

2026-06-04 chrome-cve-admin@google.com

GHSA-cxj3-85x3-g57w

Code Injection Google RCE Red Hat Suse Chrome

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 02:41 vuln.today

CVSS changed

Jun 05, 2026 - 02:22 NVD

8.8 (HIGH)

CVE Published

Jun 04, 2026 - 23:16 nvd

HIGH 8.8

CVE Published

Jun 04, 2026 - 23:16 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Script injection in Headless in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome versions prior to 149.0.7827.53 allows a remote attacker to execute arbitrary code through a crafted HTML page that triggers script injection in the Headless component. The flaw is rated High severity by Chromium and carries a CVSS 3.1 base score of 8.8, requiring only that a victim load attacker-controlled web content. No public exploit identified at time of analysis, but Google has released a fix in the Stable channel update for desktop.

Technical ContextAI

The vulnerability resides in Chrome's Headless component, which is the browser mode used for automated testing, server-side rendering, PDF generation, and tools like Puppeteer and Playwright. The root cause is classified as CWE-94 (Improper Control of Generation of Code, i.e. Code Injection), meaning input handling in the Headless rendering pipeline allows attacker-controlled HTML to inject and execute script in a context where it should not, leading to arbitrary code execution. Chrome's Headless mode shares much of the same Blink rendering and V8 JavaScript engine code as the full browser, so injection flaws here typically pivot through the same renderer process boundary.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 - update Chrome to this Stable channel version or later as documented in the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html, and also update any Chromium-based browser or embedded headless runtime once the corresponding fix lands. For server-side or CI environments using headless Chrome (Puppeteer, Playwright, Selenium, Lambda layers, container base images), rebuild images against the patched Chrome version and roll the fleet. As a compensating control until patching, restrict headless Chrome to processing only trusted HTML sources, isolate headless workers in unprivileged containers or sandboxed VMs with no network egress and no access to secrets, and disable or block navigation to attacker-controlled URLs; the trade-off is reduced functionality for any workflow that intentionally renders third-party content (e.g., link previews, screenshotting services).