What is the CVSS score of CVE-2026-10937?

CVE-2026-10937 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-10937?

Google Chrome's Passwords component (versions prior to 149.0.7827.53) contains a same-origin policy bypass that allows attackers to access or modify user credentials across different websites if a…. A patch is available.

How to fix or mitigate CVE-2026-10937?

Within 24 hours: Issue mandatory update notification to all Chrome users directing immediate upgrade to version 149.0.7827.53 or later; escalate to IT leadership for forced-update deployment if organizational policy permits. Within 7 days: Audit Chrome version compliance across all endpoints-prioritize devices with administrative access or frequent cloud service usage. Within 30 days: Complete fleet-wide remediation verification and document rollout completion for compliance records.

Google Chrome CVE-2026-10937

EUVD-2026-34386 MEDIUM

Origin Validation Error (CWE-346)

2026-06-04 chrome-cve-admin@google.com

GHSA-wccx-fxf3-qg7r

Authentication Bypass Google

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

SUSE

8.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Red Hat

9.3 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Severity Changed

Jun 05, 2026 - 20:37 NVD

HIGH MEDIUM

CVSS changed

Jun 05, 2026 - 20:37 NVD

8.1 (HIGH) 6.5 (MEDIUM)

Analysis Generated

Jun 05, 2026 - 20:22 vuln.today

CVSS changed

Jun 05, 2026 - 20:22 NVD

8.1 (HIGH)

CVSS changed

Jun 05, 2026 - 20:22 NVD

8.1 (HIGH)

CVE Published

Jun 04, 2026 - 23:16 nvd

HIGH 8.1

CVE Published

Jun 04, 2026 - 23:16 nvd

UNKNOWN (no severity yet)

DescriptionNVD

Inappropriate implementation in Passwords in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Same-origin policy bypass in Google Chrome's Passwords component prior to version 149.0.7827.53 allows remote attackers to access cross-origin resources via a crafted HTML page that a victim must visit. Rated High severity by Chromium with a CVSS of 8.1, the flaw enables exposure or modification of sensitive data across origin boundaries when a user is lured to attacker-controlled content. EPSS probability is very low (0.02%, 4th percentile) and no public exploit identified at time of analysis, but a vendor patch is available.

Technical ContextAI

The vulnerability lives in Chrome's Passwords subsystem, the component that manages stored credentials, autofill, and password-related UI surfaces. CWE-346 (Origin Validation Error) indicates that the implementation fails to correctly verify the origin of a request, message, or context before granting access - effectively breaking the Same-Origin Policy that isolates content from different web origins. In browser-internal code, this class of bug typically arises when an iframe, postMessage handler, navigation, or autofill flow trusts data without re-validating the originating security context, allowing one origin to influence behavior intended only for another. The affected product per the EUVD record is Chrome builds below 149.0.7827.53 across desktop channels referenced in the Chrome Releases blog.

RemediationAI

Upgrade Google Chrome to version 149.0.7827.53 or later on all desktop platforms - Vendor-released patch: 149.0.7827.53, as announced in the Chrome Releases stable channel update (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html). For managed fleets, force a browser relaunch via group policy or MDM (e.g., RelaunchNotification) to ensure the update takes effect, since Chrome's background updater stages binaries but requires a restart to load them. If immediate patching is not possible, compensating controls include restricting browsing to trusted sites via enterprise URL allowlists (trade-off: breaks general web usage), disabling the built-in password manager via the PasswordManagerEnabled policy and routing users to an enterprise password manager (trade-off: removes autofill convenience and may push users to weaker storage), and instructing users to avoid clicking untrusted links until the update is applied; additional context is available in the Chromium issue tracker entry at https://issues.chromium.org/issues/502651056.