What is the CVSS score of CVE-2026-10939?

CVE-2026-10939 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-10939?

Google Chrome contains a remote code execution vulnerability (CVSS 8.8) in versions prior to 149.0.7827.53 that allows attackers to compromise endpoints through malicious webpages, creating risk for…. A patch is available.

How to fix or mitigate CVE-2026-10939?

Within 24 hours: Identify all endpoints running Google Chrome versions prior to 149.0.7827.53 and assess the scope of deployment across your organization. Within 7 days: Deploy Chrome 149.0.7827.53 or later organization-wide through your standard patch management process, prioritizing systems used by employees with critical business functions. Within 30 days: Complete verification that all Chrome instances are running the patched version and document your remediation completion.

Google Chrome CVE-2026-10939

EUVD-2026-34388 HIGH

Use After Free (CWE-416)

2026-06-04 chrome-cve-admin@google.com

GHSA-559c-2p8c-m9v4

RCE Denial Of Service Google Use After Free Memory Corruption

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 02:44 vuln.today

CVSS changed

Jun 05, 2026 - 02:22 NVD

8.8 (HIGH)

CVE Published

Jun 04, 2026 - 23:16 nvd

HIGH 8.8

CVE Published

Jun 04, 2026 - 23:16 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Use after free in WebRTC in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome versions prior to 149.0.7827.53 allows a remote attacker to run arbitrary code inside the renderer sandbox by luring a victim to a crafted HTML page that triggers a use-after-free in the WebRTC component. The flaw carries a CVSS 3.1 score of 8.8 (High) and Chromium rates the security severity as High; no public exploit has been identified at time of analysis and the issue is not currently listed in CISA KEV.

Technical ContextAI

WebRTC is the real-time communications stack embedded in Chromium that handles peer-to-peer audio, video, and data channels through APIs such as RTCPeerConnection, RTCDataChannel, and getUserMedia, and it processes complex untrusted input (SDP, ICE, RTP/SRTP, DTLS) inside the renderer process. The root cause class, CWE-416 (Use After Free), means an object referenced by WebRTC code is freed while a dangling pointer is still reachable, so subsequent reuse of that memory can be steered by an attacker to corrupt the heap and gain arbitrary read/write or control of program flow. Because the bug lives in the renderer, successful exploitation yields code execution constrained to Chrome's sandbox (scope unchanged per CVSS S:U), and additional sandbox-escape bugs would be required to reach the host operating system.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 - update Chrome via the built-in updater or by relaunching the browser, then verify the version under chrome://settings/help, per the stable channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. In managed environments, push the update through the Chrome Enterprise MSI/policy channel and reboot or restart the browser so the new renderer binaries load; users of Edge, Brave, Opera, and other Chromium-based browsers should install the equivalent release from their respective vendors once published. If patching must be deferred briefly, compensating controls include disabling WebRTC via enterprise policy (Chrome's WebRtcAllowLegacyTLSProtocols/URLAllowlist plus extensions like "WebRTC Control"), or blocking outbound STUN/TURN and restricting browsing to trusted sites via proxy allowlisting - note that disabling WebRTC will break Google Meet, Teams web, Zoom web client, and other RTC-dependent apps, and URL allowlisting still leaves any compromised allowlisted site as an exploitation path.