What is the CVSS score of CVE-2026-10951?

CVE-2026-10951 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-10951?

A remote code execution vulnerability in Google Chrome for iOS (CVE-2026-10951) enables arbitrary code execution through malicious websites.. A patch is available.

How to fix or mitigate CVE-2026-10951?

Within 24 hours: Identify all iOS devices running Chrome versions prior to 149.0.7827.53 using your Mobile Device Management system. Within 7 days: Deploy Chrome version 149.0.7827.53 or later to all affected iOS devices through your MDM or app distribution system. Within 30 days: Verify patch deployment completion (target 95%+ compliance) and audit for any unauthorized access or data exfiltration during the interim period.

Google Chrome CVE-2026-10951

EUVD-2026-34400 HIGH

Use After Free (CWE-416)

2026-06-04 chrome-cve-admin@google.com

GHSA-h7rf-vm92-f53j

Denial Of Service Google Use After Free Memory Corruption Apple

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 20:23 vuln.today

CVSS changed

Jun 05, 2026 - 20:22 NVD

8.8 (HIGH)

CVSS changed

Jun 05, 2026 - 20:22 NVD

8.8 (HIGH)

CVE Published

Jun 04, 2026 - 23:16 nvd

HIGH 8.8

CVE Published

Jun 04, 2026 - 23:16 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Use after free in Autofill in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Heap corruption in Google Chrome on iOS before version 149.0.7827.53 enables remote attackers to potentially execute arbitrary code by enticing a user to interact with a malicious HTML page that triggers a use-after-free in the Autofill component. Chromium rates the underlying flaw as High severity, and while a vendor patch is available, no public exploit has been identified at time of analysis and EPSS remains very low at 0.03%.

Technical ContextAI

The vulnerability resides in Chrome's Autofill subsystem, which manages saved form data such as addresses, payment information, and credentials. CWE-416 (Use After Free) indicates that memory is referenced after it has been freed, allowing an attacker who can influence heap layout and reallocation to control the contents of the dangling pointer's target. On iOS, Chrome is required by Apple's App Store policy to use WebKit as the rendering engine rather than Blink, so the vulnerable code path lives in Chrome's iOS-specific Autofill UI/logic layer rather than the cross-platform Blink renderer. Successful exploitation typically pivots from heap corruption to arbitrary code execution within the affected browser process context.

RemediationAI

Upgrade Google Chrome on iOS to version 149.0.7827.53 or later - this is the vendor-released patch and the only complete fix. Users should update via the Apple App Store and enterprise fleets managed through MDM should push the updated build; verify deployment by checking chrome://version or the iOS App Store update history. As an interim compensating control where patching is delayed, disable Chrome Autofill (Settings → Addresses, Payment methods, and Passwords) to remove the attack surface, accepting the usability trade-off of manual form entry; alternatively, instruct users to avoid using Chrome on iOS for browsing untrusted content until the update is applied. Reference the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for the canonical fix notice.