What is the CVSS score of CVE-2026-10930?

CVE-2026-10930 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-10930?

Google Chrome on macOS versions prior to 149.0.7827.53 contains an out-of-bounds memory read vulnerability (CVE-2026-10930) that could allow attackers to disclose sensitive information or crash the…. A patch is available.

How to fix or mitigate CVE-2026-10930?

Within 24 hours: Inventory all Chrome installations on macOS endpoints and establish patching timeline. Within 7 days: Deploy Google Chrome version 149.0.7827.53 or later across all affected macOS systems through standard patch management procedures. Within 30 days: Verify deployment completion and document remediation in your vulnerability tracking system.

Google Chrome CVE-2026-10930

EUVD-2026-34379 HIGH

Out-of-bounds Read (CWE-125)

2026-06-04 chrome-cve-admin@google.com

GHSA-8hmc-m9jw-q8ph

Information Disclosure Google Buffer Overflow Red Hat Suse Chrome

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

SUSE

HIGH

qualitative

Red Hat

6.5 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 22:30 vuln.today

CVSS changed

Jun 05, 2026 - 20:22 NVD

8.1 (HIGH)

CVSS changed

Jun 05, 2026 - 20:22 NVD

8.1 (HIGH)

CVE Published

Jun 04, 2026 - 23:16 nvd

HIGH 8.1

CVE Published

Jun 04, 2026 - 23:16 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Out of bounds read in ANGLE in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Out-of-bounds memory read in Google Chrome's ANGLE graphics layer on macOS versions prior to 149.0.7827.53 allows remote attackers to disclose memory contents or crash the renderer by enticing a user to visit a crafted HTML page. Google rates the underlying Chromium issue as High severity, and while no public exploit is identified at time of analysis, the EPSS score of 0.03% suggests low near-term mass exploitation likelihood. The flaw requires user interaction (visiting a page) but no authentication, making drive-by web attacks the realistic threat model.

Technical ContextAI

ANGLE (Almost Native Graphics Layer Engine) is the translation layer Chrome uses to map WebGL and OpenGL ES API calls onto the host platform's native graphics API - on macOS this typically means Metal or the legacy OpenGL backend. The CWE-125 (Out-of-bounds Read) root cause indicates that ANGLE reads past the bounds of an allocated buffer when processing attacker-controlled graphics data, likely while parsing shader inputs, texture data, or vertex/index buffers supplied through WebGL from a webpage. Because ANGLE runs inside Chrome's GPU/renderer process, the read can leak memory contents from those processes, which may include sensitive data such as cross-origin pixel data, JavaScript heap fragments, or other process state that aids further exploitation.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 or later for macOS - update via Chrome's built-in updater (chrome://settings/help) or redeploy through managed-update tooling such as Jamf, Intune, or Chrome Browser Cloud Management; details are in the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. As a compensating control until patching completes, administrators can disable WebGL via the WebGLAllowedForUrls/DefaultWebGLSetting enterprise policies or by setting the chrome://flags WebGL option, which removes the most likely attack surface for ANGLE bugs but breaks legitimate 3D web content, in-browser games, and some mapping and data-visualization sites. Restricting browsing to a curated allowlist via URLBlocklist/URLAllowlist policies further reduces exposure to attacker-controlled HTML at the cost of user productivity.