What is the CVSS score of CVE-2026-10929?

CVE-2026-10929 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-10929?

Google Chrome on Android versions prior to 149.0.7827.53 contain a high-severity sandbox escape vulnerability that could allow attackers to escalate privileges following a renderer compromise,…. A patch is available.

How to fix or mitigate CVE-2026-10929?

Within 24 hours: Inventory Chrome on Android devices across the organization and identify those running versions prior to 149.0.7827.53 using MDM or mobile device inventory tools. Within 7 days: Deploy Chrome 149.0.7827.53 or later to all affected devices; configure automatic updates where feasible. Within 30 days: Verify complete remediation through MDM telemetry and endpoint scanning; document compliance for audit purposes.

Google Chrome CVE-2026-10929

EUVD-2026-34378 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-06-04 chrome-cve-admin@google.com

GHSA-3pf9-jfpx-834g

Heap Overflow Google Buffer Overflow Red Hat Suse Chrome

8.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.0 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 02:41 vuln.today

CVSS changed

Jun 05, 2026 - 02:22 NVD

8.3 (HIGH)

CVE Published

Jun 04, 2026 - 23:16 nvd

HIGH 8.3

CVE Published

Jun 04, 2026 - 23:16 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Heap buffer overflow in ANGLE in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome on Android prior to 149.0.7827.53 allows a remote attacker who has already compromised the renderer process to break out of the sandbox via a crafted HTML page that triggers a heap buffer overflow in ANGLE. Chromium rates the severity as High, and although no public exploit is identified at time of analysis, the CVSS 8.3 score with scope change reflects the cross-boundary impact when chained with a renderer RCE. This is a classic second-stage bug used in browser exploit chains rather than a standalone one-click compromise.

Technical ContextAI

ANGLE (Almost Native Graphics Layer Engine) is the abstraction layer Chromium uses to translate OpenGL ES API calls - primarily from WebGL and WebGPU content - into the underlying graphics backend (Vulkan/OpenGL on Android). Because ANGLE processes attacker-influenced shader and graphics state inside the GPU process, it is a recurring target for sandbox escapes. The CWE-122 classification (heap-based buffer overflow) indicates the bug corrupts memory on the heap, typical of incorrect bounds checks on GPU command buffers or texture/buffer sizing. On Android, a successful escape from the renderer through ANGLE typically lands code execution in the more privileged GPU process, expanding access beyond the per-site renderer sandbox.

RemediationAI

Vendor-released patch: Google Chrome for Android 149.0.7827.53 - update via the Google Play Store or managed device tooling and confirm the running build is at or above this version. The advisory is published at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html with the upstream bug reference at https://issues.chromium.org/issues/500429259. If patching is delayed in a managed fleet, compensating controls include disabling WebGL/WebGPU via enterprise policy (HardwareAccelerationModeEnabled=false or DefaultWebGLEnabled=false), which removes most ANGLE attack surface at the cost of breaking 3D/graphics web apps, and restricting browsing to a known allowlist via URLAllowlist/URLBlocklist policies to reduce exposure to attacker-controlled HTML; both controls degrade user experience and should be temporary while the update rolls out.