What is the CVSS score of CVE-2026-10936?

CVE-2026-10936 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-10936?

Google Chrome prior to version 149.0.7827.53 contains a remote code execution vulnerability that allows attackers to compromise user systems through malicious websites, potentially giving them access…. A patch is available.

How to fix or mitigate CVE-2026-10936?

Within 24 hours: Identify all Google Chrome installations across the organization and issue a security advisory requiring immediate upgrade to Chrome 149.0.7827.53 or later. Within 7 days: Deploy patched Chrome version to all user systems using organizational MDM or patch management tools. Within 30 days: Audit and verify 100% patch compliance across all Chrome deployments; evaluate enforcing automatic updates organization-wide to prevent future delays.

Google Chrome CVE-2026-10936

EUVD-2026-34385 HIGH

Access of Resource Using Incompatible Type (Type Confusion) (CWE-843)

2026-06-04 chrome-cve-admin@google.com

GHSA-45pc-7vpj-9mr4

RCE Google Memory Corruption

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 02:44 vuln.today

CVSS changed

Jun 05, 2026 - 02:22 NVD

8.8 (HIGH)

CVE Published

Jun 04, 2026 - 23:16 nvd

HIGH 8.8

CVE Published

Jun 04, 2026 - 23:16 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Type Confusion in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome's V8 JavaScript engine prior to version 149.0.7827.53 allows attackers to execute arbitrary code within the renderer sandbox by luring a user to a malicious web page. The flaw stems from a type confusion bug rated High severity by Chromium's security team, and while no public exploit has been identified at time of analysis, V8 type confusion bugs are historically high-value targets for browser exploitation chains. A vendor patch is available.

Technical ContextAI

The vulnerability resides in V8, the open-source JavaScript and WebAssembly engine that powers Chrome and Chromium-derived browsers (Edge, Brave, Opera, Vivaldi). CWE-843 (Access of Resource Using Incompatible Type - 'Type Confusion') occurs when code allocates or accesses a resource using one type but later interprets the memory layout as a different, incompatible type. In V8, this typically arises from JIT optimization assumptions being violated (e.g., a hidden class or map check being bypassed), allowing attacker-controlled JavaScript to read or write memory outside the intended object structure. This primitive is commonly weaponized into arbitrary read/write within the renderer process, leading to arbitrary code execution inside Chrome's sandbox.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 - update Chrome via Help → About Google Chrome on all desktop endpoints and restart the browser to apply the fix, as documented in the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html and the upstream issue tracker entry at https://issues.chromium.org/issues/502439789. For managed fleets, push the update via Chrome Browser Cloud Management, Group Policy, or MDM and verify deployment with version inventory. Until patching completes, compensating controls include enabling Chrome's Site Isolation (default on desktop) which limits a compromised renderer's reach, deploying browser isolation or restrictive proxy/DNS filtering to block untrusted sites (trade-off: user friction and operational overhead), and considering --js-flags=--jitless as a hardening measure for high-risk users which disables V8's JIT and removes a major attack surface but materially degrades JavaScript performance on modern web apps. Users of Chromium-based browsers (Edge, Brave, Opera, Vivaldi) should update to the version that incorporates the V8 fix as published by each vendor.