What is the CVSS score of CVE-2026-10933?

CVE-2026-10933 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-10933?

Google Chrome on Windows versions prior to 149.0.7827.53 contain a high-severity sandbox escape vulnerability in the Audio component that could allow attackers with a previously compromised renderer…. A patch is available.

How to fix or mitigate CVE-2026-10933?

24 hours: Inventory all Windows Chrome installations and initiate automatic update deployment to Chrome 149.0.7827.53 or later through your device management platform. 7 days: Verify deployment completion across 95% of Windows Chrome users. 30 days: Confirm 100% deployment completion and establish monitoring alerts for exploitation attempts in security logs.

Google Chrome CVE-2026-10933

EUVD-2026-34382 HIGH

Use After Free (CWE-416)

2026-06-04 chrome-cve-admin@google.com

GHSA-j656-4p6j-h695

Denial Of Service Google Use After Free Memory Corruption Microsoft

8.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.2 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 02:42 vuln.today

CVSS changed

Jun 05, 2026 - 02:22 NVD

8.3 (HIGH)

CVE Published

Jun 04, 2026 - 23:16 nvd

HIGH 8.3

CVE Published

Jun 04, 2026 - 23:16 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Use after free in Audio in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome on Windows before 149.0.7827.53 allows a remote attacker who has already compromised the renderer process to break out via a use-after-free in the Audio component when a victim loads a crafted HTML page. Chromium rates the issue High severity and Google has shipped a stable-channel fix, but no public exploit identified at time of analysis and the bug is not listed in CISA KEV.

Technical ContextAI

The flaw is a CWE-416 Use-After-Free in Chromium's Audio subsystem, which on Windows runs in the browser/audio service process outside the renderer sandbox. UAF bugs in this surface typically arise from a media stream object being freed while another code path still holds a dangling pointer, letting an attacker reclaim the freed slot with controlled data and hijack execution. Because the Audio service brokers IPC from sandboxed renderers, a corrupted object there is a classic stepping stone from a renderer compromise to higher-privileged code execution, which is why this class of bug is consistently used as the second link in Chrome exploit chains.

RemediationAI

Vendor-released patch: update Google Chrome on Windows to 149.0.7827.53 or later via the Stable channel auto-update, then force a browser restart so the patched binaries actually load (per https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html). In managed environments, push the update via Chrome Browser Cloud Management or Group Policy and verify deployment with chrome://version; for downstream Chromium browsers, wait for and apply their respective backported builds. If patching must be deferred briefly, compensating controls include disabling the Audio Service via the --disable-features=AudioServiceOutOfProcess flag or AudioSandboxEnabled policy (trade-off: degrades audio reliability and removes a defense-in-depth boundary), and restricting users to known-good sites via SafeSites/URLBlocklist to reduce odds of landing on a chained-exploit page (trade-off: high admin overhead and breaks general browsing).