What is the CVSS score of CVE-2026-10932?

CVE-2026-10932 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-10932?

Google Chrome on Android before version 149.0.7827.53 contains a heap corruption vulnerability that attackers can exploit remotely through malicious websites, affecting the security posture of all…. A patch is available.

How to fix or mitigate CVE-2026-10932?

Within 24 hours: Inventory all Android devices running Chrome and identify those on versions before 149.0.7827.53; communicate patch urgency to users. Within 7 days: Deploy Chrome 149.0.7827.53 or later to all affected Android devices using automated updates or mobile device management. Within 30 days: Audit deployment completion and enforce Chrome auto-update policies to prevent recurrence of outdated vulnerable versions.

Google Chrome CVE-2026-10932

EUVD-2026-34381 HIGH

Use After Free (CWE-416)

2026-06-04 chrome-cve-admin@google.com

GHSA-v4qh-wp8v-x2xq

Denial Of Service Use After Free Memory Corruption Google Red Hat Suse Chrome

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 02:41 vuln.today

CVSS changed

Jun 05, 2026 - 02:22 NVD

8.8 (HIGH)

CVE Published

Jun 04, 2026 - 23:16 nvd

HIGH 8.8

CVE Published

Jun 04, 2026 - 23:16 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Use after free in UI in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Heap corruption in Google Chrome on Android before 149.0.7827.53 enables remote attackers to exploit a use-after-free condition in the browser's UI component through a malicious web page. The flaw carries a CVSS 8.8 (High) rating and requires user interaction (visiting a crafted page), with no public exploit identified at time of analysis. Google rates the underlying Chromium severity as High, and a vendor patch is available in the stable channel update.

Technical ContextAI

The vulnerability is rooted in CWE-416 (Use After Free), a memory-safety class where code continues to reference heap memory after it has been freed, allowing attackers to manipulate the dangling pointer to corrupt the heap. The defect resides in Chrome's UI subsystem on Android, which is built on the Chromium engine and shares much of its rendering and process-model code with desktop Chrome. Use-after-free issues in browser UI code are particularly impactful because UI components frequently run in privileged browser-process contexts, meaning successful exploitation can lead to sandbox-adjacent code execution rather than being confined to the renderer sandbox.

RemediationAI

Patch available per vendor advisory: update Google Chrome on Android to version 149.0.7827.53 or later via the Google Play Store or managed-device update channel, as documented in the Chrome Releases blog post at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html and tracked in Chromium issue https://issues.chromium.org/issues/501335606. Where immediate patching is not feasible, compensating controls include enforcing enterprise policy to block navigation to untrusted sites via URL allowlisting (trade-off: breaks legitimate browsing), deploying Site Isolation and Strict Site Isolation policies (already default but worth verifying), and instructing users to avoid clicking untrusted links until updates roll out. Disabling Chrome entirely in favor of another browser is rarely practical on Android and shifts rather than eliminates browser-engine risk.