What is the CVSS score of CVE-2026-10957?

CVE-2026-10957 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-10957?

Google Chrome versions prior to 149.0.7827.53 contain a remote code execution vulnerability that could compromise organizational endpoints when users visit malicious websites; no public exploit has…. A patch is available.

How to fix or mitigate CVE-2026-10957?

Within 24 hours: Inventory all Chrome deployments and confirm patch availability in your environment. Within 7 days: Deploy Google Chrome version 149.0.7827.53 or later to all endpoints via your endpoint management tool. Within 30 days: Verify patch deployment to 100% of Chrome instances and document remediation completion.

Google Chrome CVE-2026-10957

EUVD-2026-34406 HIGH

Use After Free (CWE-416)

2026-06-04 chrome-cve-admin@google.com

GHSA-gcvq-rhh6-87pp

Google Memory Corruption RCE Use After Free Denial Of Service Red Hat Suse Chrome

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 02:51 vuln.today

CVSS changed

Jun 05, 2026 - 02:22 NVD

8.8 (HIGH)

CVE Published

Jun 04, 2026 - 23:16 nvd

HIGH 8.8

CVE Published

Jun 04, 2026 - 23:16 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Use after free in Glic in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome versions prior to 149.0.7827.53 stems from a use-after-free flaw in the Glic component, allowing a remote attacker to run arbitrary code within the renderer sandbox by luring a victim to a crafted HTML page. Google has rated the Chromium security severity as High, and a vendor patch is available, though no public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.

Technical ContextAI

The flaw resides in Glic, a Chrome component shipped in Chromium-based browsers built on the Blink rendering engine and V8 JavaScript runtime. CWE-416 (Use After Free) occurs when memory is referenced after it has been deallocated, typically through dangling pointers in C++ object lifecycles; in a renderer context this commonly arises from mismatched object ownership during asynchronous DOM, IPC, or feature-state transitions. Successful exploitation corrupts the heap inside the renderer process, which Chrome confines through its multi-process sandbox, so arbitrary code execution is initially constrained to the sandboxed renderer rather than the host OS unless chained with a sandbox escape.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 or later on the stable desktop channel - upgrade immediately via the built-in updater or by redeploying managed installers, referencing the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Administrators of Chromium-based browsers should track and apply their respective downstream releases once they incorporate the equivalent Glic fix. Where patching is delayed, compensating controls include enforcing Site Isolation (already on by default) to limit cross-origin impact, blocking access to untrusted sites via enterprise policy or web proxy categorization, and disabling or restricting the Glic feature through enterprise policy if exposed in the deployed channel - note that broad URL blocking can disrupt legitimate browsing and Glic restrictions may degrade dependent product functionality.