What is the CVSS score of CVE-2026-10948?

CVE-2026-10948 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-10948?

A high-severity remote code execution vulnerability in Google Chrome's WebRTC component (CVE-2026-10948) could allow attackers to execute arbitrary code on user systems through malicious webpages.. A patch is available.

How to fix or mitigate CVE-2026-10948?

Within 24 hours: Issue mandatory browser update directive requiring Google Chrome version 149.0.7827.53 or later. Within 7 days: Verify deployment completion through endpoint management systems; enable automatic updates if not already enforced. Within 30 days: Review security logs and telemetry for WebRTC-related exploitation indicators.

Google Chrome CVE-2026-10948

EUVD-2026-34397 HIGH

Use After Free (CWE-416)

2026-06-04 chrome-cve-admin@google.com

GHSA-j37x-vwqp-7x2h

Google Memory Corruption RCE Use After Free Denial Of Service

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 02:48 vuln.today

CVSS changed

Jun 05, 2026 - 02:22 NVD

8.8 (HIGH)

CVE Published

Jun 04, 2026 - 23:16 nvd

HIGH 8.8

CVE Published

Jun 04, 2026 - 23:16 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Use after free in WebRTC in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome prior to 149.0.7827.53 allows a remote attacker to trigger a use-after-free condition in the WebRTC component by enticing a victim to visit a crafted HTML page, resulting in arbitrary code execution within the renderer sandbox. Google rated this as High severity and a vendor patch is available; no public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.

Technical ContextAI

The flaw resides in WebRTC (Web Real-Time Communication), the browser subsystem that handles peer-to-peer audio, video, and data channels used by video conferencing and real-time media web applications. The root cause is CWE-416 (Use After Free), a memory corruption class in which a pointer continues to reference an object whose backing memory has already been freed; subsequent use of that pointer can let an attacker hijack control flow when the freed allocation is replaced with attacker-controlled data. WebRTC is implemented in C++ inside the Chromium renderer process and exposes a wide attack surface through JavaScript APIs (RTCPeerConnection, RTCDataChannel, getUserMedia), making it a recurring source of high-severity memory safety issues in Chrome.

RemediationAI

Vendor-released patch: upgrade Google Chrome to version 149.0.7827.53 or later on the stable desktop channel as described in the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Enterprise administrators should push the update via Chrome Browser Cloud Management, Group Policy, or their existing patch management system and force-restart browsers to apply the fix. If immediate patching is not possible, compensating controls include disabling WebRTC via enterprise policy (URLBlocklist of webrtc:// schemes or the WebRtcAllowLegacyTLSProtocols / WebRtcUdpPortRange policies to constrain functionality) - with the trade-off that video conferencing tools like Google Meet, Microsoft Teams web client, and Jitsi will break - or restricting browsing to allowlisted internal sites until the update is deployed.