What is the CVSS score of CVE-2026-10946?

CVE-2026-10946 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-10946?

Google Chrome versions before 149.0.7827.53 contain a heap buffer overflow in the Media component enabling arbitrary code execution within the browser renderer when users visit malicious websites.. A patch is available.

How to fix or mitigate CVE-2026-10946?

Within 24 hours: Audit Chrome deployment scope and patch testing requirements in your environment. Within 7 days: Deploy Chrome 149.0.7827.53 or later to all managed systems via Windows Server Update Services (WSUS), macOS MDM, or Linux package managers as applicable. Within 30 days: Verify 100% deployment completion and confirm no endpoints remain on versions prior to 149.0.7827.53.

Google Chrome CVE-2026-10946

EUVD-2026-34395 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-06-04 chrome-cve-admin@google.com

GHSA-7xw6-44mq-f9j5

Heap Overflow Google Buffer Overflow RCE

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 02:47 vuln.today

CVSS changed

Jun 05, 2026 - 02:22 NVD

7.5 (HIGH)

CVE Published

Jun 04, 2026 - 23:16 nvd

HIGH 7.5

CVE Published

Jun 04, 2026 - 23:16 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Heap buffer overflow in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Heap buffer overflow in the Media component of Google Chrome before 149.0.7827.53 enables remote attackers to achieve arbitrary code execution within the renderer sandbox after luring a user to a crafted HTML page and tricking them into performing specific UI gestures. Google rates the underlying Chromium issue as High severity, and while publicly available exploit code exists is not confirmed, vendor patches have been released through the Stable channel update. No active exploitation has been reported via CISA KEV at time of analysis.

Technical ContextAI

The flaw resides in Chrome's Media subsystem, which handles audio/video decoding, playback pipelines, and related HTML5 media element processing within the Blink/Chromium renderer process. CWE-122 (Heap-based Buffer Overflow) indicates that attacker-controlled media data causes a write past the bounds of a heap-allocated buffer, typically corrupting adjacent heap metadata or object pointers that can be steered into control-flow hijack. Because the affected CPE corresponds to the Chromium-based desktop browser (Chrome stable channel), the same code path likely impacts other Chromium derivatives (Edge, Brave, Opera, Vivaldi) until they uptake the upstream fix tracked in chromium issue 504587797.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 - update Chrome on all desktop endpoints to 149.0.7827.53 or later via the Stable channel update documented at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html, and force a browser relaunch so the new binary is loaded. Managed environments should push the update via Chrome Browser Cloud Management, Group Policy (UpdateDefault/TargetVersionPrefix), or Jamf/Intune MDM and verify chrome://version reflects the fixed build. As a temporary compensating control until the update propagates, restrict browsing of untrusted media-heavy sites, disable autoplay (chrome://settings/content/sound), or enforce site isolation and strict Enhanced Safe Browsing; users of Chromium-derivative browsers (Edge, Brave, Opera, Vivaldi) should update once their respective vendors uptake the Chromium fix tracked at https://issues.chromium.org/issues/504587797. Note that disabling JavaScript or media globally will break most modern web functionality and is not a sustainable workaround.