What is the CVSS score of CVE-2026-10958?

CVE-2026-10958 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome iOS are affected by CVE-2026-10958?

Google Chrome for iOS contains a remote code execution vulnerability affecting all users running versions prior to 149.0.7827.53.. A patch is available.

How to fix or mitigate CVE-2026-10958?

Within 24 hours: Inventory Chrome for iOS deployments and notify all iOS users of the critical security update. Within 7 days: Deploy Chrome for iOS version 149.0.7827.53 or later via mobile device management or app store channels; monitor deployment metrics. Within 30 days: Confirm 95%+ installation completion and identify any devices unable to update.

Google Chrome iOS CVE-2026-10958

EUVD-2026-34407 HIGH

Use After Free (CWE-416)

2026-06-04 chrome-cve-admin@google.com

GHSA-cr6q-j4hh-gx6r

RCE Denial Of Service Google Use After Free Memory Corruption Apple

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 02:52 vuln.today

CVSS changed

Jun 05, 2026 - 02:22 NVD

8.8 (HIGH)

CVE Published

Jun 04, 2026 - 23:16 nvd

HIGH 8.8

CVE Published

Jun 04, 2026 - 23:16 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Use after free in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome for iOS before 149.0.7827.53 allows a remote attacker to execute arbitrary code by enticing a user to visit a crafted HTML page and perform specific UI gestures, triggering a use-after-free condition. Google rates the underlying Chromium issue as High severity, and no public exploit has been identified at time of analysis. The flaw requires user interaction, which somewhat reduces but does not eliminate real-world risk given Chrome's massive install base on iOS.

Technical ContextAI

The vulnerability is classified as CWE-416 (Use After Free), a memory corruption class where code accesses heap memory after it has been freed, often resulting in attacker-controlled function pointer dereferences or type confusion that can be steered into arbitrary code execution. Although iOS forces all third-party browsers to use Apple's WebKit rendering engine, Chrome for iOS ships substantial Chromium-derived browser-layer code (UI, navigation, IPC, profile, and feature subsystems) where this UAF resides, as evidenced by tracking under the Chromium issue tracker (issues.chromium.org/issues/507251069) and disclosure via chrome-cve-admin@google.com. Exploitation depends on triggering the dangling-pointer code path via a malicious page combined with a specific UI gesture sequence that releases an object still referenced by the engine.

RemediationAI

Vendor-released patch: Google Chrome for iOS 149.0.7827.53 - upgrade affected installations to this build or later via the Apple App Store, as announced in Google's Chrome Releases advisory (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html). Because iOS auto-updates apps only when enabled, administrators of managed Apple fleets should push the updated Chrome version through MDM (e.g., Intune, Jamf) and verify the installed build. Until patching is complete, compensating controls include restricting Chrome use on iOS in favor of Safari for sensitive browsing, blocking known malicious domains at the network edge, and user-awareness messaging to avoid interacting with untrusted pages; note these are weak controls against a drive-by web exploit and do not substitute for the update.