What is the CVSS score of CVE-2026-10959?

CVE-2026-10959 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-10959?

Google Chrome for Android versions prior to 149.0.7827.53 contain a high-severity use-after-free vulnerability enabling remote code execution through malicious websites.. A patch is available.

How to fix or mitigate CVE-2026-10959?

24 hours: Identify Chrome deployment scope across managed devices and BYOD inventory; issue user advisory on patch availability. 7 days: Deploy Chrome 149.0.7827.53 or later via MDM, Google Play auto-update, and employee communication channels. 30 days: Verify patch installation exceeds 90% coverage and document completion status by device class.

Google Chrome CVE-2026-10959

EUVD-2026-34408 HIGH

Use After Free (CWE-416)

2026-06-04 chrome-cve-admin@google.com

GHSA-r535-vj4v-w8rf

RCE Denial Of Service Google Use After Free Memory Corruption

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 02:52 vuln.today

CVSS changed

Jun 05, 2026 - 02:22 NVD

8.8 (HIGH)

CVE Published

Jun 04, 2026 - 23:16 nvd

HIGH 8.8

CVE Published

Jun 04, 2026 - 23:16 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Use after free in Input in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandboxed remote code execution in Google Chrome on Android prior to 149.0.7827.53 allows a remote attacker to execute arbitrary code inside the renderer sandbox by luring a user to a crafted HTML page. The flaw is a use-after-free in the Input component, rated High by Chromium and 8.8 by CVSS. No public exploit identified at time of analysis, but Chrome UAF bugs in renderer-reachable components are historically high-value targets for chained sandbox escapes.

Technical ContextAI

The vulnerability is a CWE-416 Use-After-Free in Chrome's Input subsystem, which handles pointer, touch, keyboard, and gesture event dispatch within the Blink/Chromium renderer process. UAF flaws occur when memory is freed while a dangling pointer remains in use, allowing an attacker who controls subsequent heap allocations to overwrite the freed object with attacker-controlled data and hijack control flow. Affected component per EUVD CPE data is Google Chrome on Android at versions below 149.0.7827.53; the Chromium advisory and issue tracker entry (issues.chromium.org/507258648) are not yet publicly viewable, consistent with Chrome's standard practice of restricting bug visibility until a majority of users have updated.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 for Android - update via Google Play or managed Android update channels and confirm the new version under chrome://version after install. Enterprise administrators using Managed Google Play or MDM should push the update to all enrolled Android devices and verify rollout, referencing the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html and the Chromium issue at https://issues.chromium.org/issues/507258648. Where immediate patching is not possible, compensating controls include restricting browsing to trusted sites via MDM URL allowlists (trade-off: breaks general web use), enabling Site Isolation if not already on (trade-off: higher memory use), and steering users to an alternate browser temporarily; disabling JavaScript globally would also blunt this class of UAF but renders most modern web apps unusable.