What is the CVSS score of CVE-2026-10940?

CVE-2026-10940 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-10940?

Google Chrome for Windows contains a sandbox escape vulnerability (CVE-2026-10940) that allows attackers who have already compromised the browser's renderer process to break system isolation and…. A patch is available.

How to fix or mitigate CVE-2026-10940?

Within 24 hours: Inventory Chrome deployments across Windows endpoints and identify systems running versions prior to 149.0.7827.53. Within 7 days: Deploy Chrome 149.0.7827.53 or later to all affected systems and verify automatic update mechanisms are enabled. Within 30 days: Audit deployment completion and address any systems that remain unpatched.

Google Chrome CVE-2026-10940

EUVD-2026-34389 HIGH

Race Condition (CWE-362)

2026-06-04 chrome-cve-admin@google.com

GHSA-6m9f-mqw5-jc8m

Information Disclosure Google Microsoft Race Condition Chrome

8.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

7.9 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 02:45 vuln.today

CVSS changed

Jun 05, 2026 - 02:22 NVD

8.3 (HIGH)

CVE Published

Jun 04, 2026 - 23:16 nvd

HIGH 8.3

CVE Published

Jun 04, 2026 - 23:16 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Race in Codecs in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome on Windows prior to 149.0.7827.53 enables a remote attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page that triggers a race condition in the Codecs component. Chromium rates this High severity, and while no public exploit was identified at time of analysis, the bug fits the classic renderer-to-sandbox-escape pattern frequently chained in real-world Chrome exploit kits. CVSS is 8.3 reflecting high attack complexity, required user interaction, and a scope change.

Technical ContextAI

The flaw lives in Chrome's Codecs subsystem on Windows and is classified as CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization, i.e. a race condition). Codecs run partially in privileged broker/utility processes that mediate hardware-accelerated media decoding for the sandboxed renderer; when synchronization between renderer-supplied state and the higher-privilege codec handler is improper, an attacker who already controls renderer memory can win a race to corrupt shared state and escape the sandbox. The Chromium tracker (issues.chromium.org/503879873) and the Stable Channel update post on chromereleases.googleblog.com describe this as a Windows-specific defect, consistent with platform-specific Media Foundation/codec pipelines used on that OS.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 on Windows - update via the built-in updater (chrome://settings/help) or by redeploying the MSI from enterprise distribution channels, as referenced in the Stable Channel update post at chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html and the Chromium issue tracker entry issues.chromium.org/503879873. Administrators managing Chromium-based browsers should monitor their respective vendor advisories and roll those updates as soon as they ship. If patching cannot be performed immediately, compensating controls include enforcing site isolation (already default but verify policy SitePerProcess=1), disabling hardware-accelerated video decoding via the DisableHardwareAcceleration enterprise policy to reduce attack surface in the Codecs path (side effect: degraded video performance and higher CPU on streaming sites), and tightening attack-surface reduction policies to block unknown executables spawned from browser processes - none of these stop a determined renderer-chained exploit, only patching does.