What is the CVSS score of CVE-2026-10960?

CVE-2026-10960 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-10960?

Google Chrome versions before 149.0.7827.53 contain a sandbox escape vulnerability that allows attackers who have compromised the Chrome renderer process to execute code directly on the host system,…. A patch is available.

How to fix or mitigate CVE-2026-10960?

Within 24 hours: Identify all systems running Chrome versions prior to 149.0.7827.53 through asset inventory and endpoint monitoring. Within 7 days: Distribute Chrome 149.0.7827.53 or later to all endpoints via standard patch management channels; prioritize employees in high-value roles and customer-facing functions. Within 30 days: Audit patch deployment completion; implement browser auto-update policies or version pinning controls to prevent future sandbox escape exposure.

Google Chrome CVE-2026-10960

EUVD-2026-34409 HIGH

Use of Uninitialized Variable (CWE-457)

2026-06-04 chrome-cve-admin@google.com

GHSA-v23v-2p63-r7jw

Information Disclosure Google

8.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

7.9 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 02:53 vuln.today

CVSS changed

Jun 05, 2026 - 02:22 NVD

8.3 (HIGH)

CVE Published

Jun 04, 2026 - 23:16 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:16 nvd

HIGH 8.3

DescriptionCVE.org

Uninitialized Use in Codecs in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome versions prior to 149.0.7827.53 allows a remote attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page exploiting an uninitialized memory use in the Codecs component. Google has rated this Chromium security severity as High, and no public exploit has been identified at time of analysis. The flaw requires chaining with a separate renderer compromise, but combined with a renderer RCE it enables full host code execution outside Chrome's sandbox.

Technical ContextAI

The vulnerability resides in Chrome's Codecs subsystem, which handles audio/video decoding inside the renderer process and interacts with privileged broker processes across the sandbox boundary. CWE-457 (Use of Uninitialized Variable) indicates that a memory region - likely a struct field, pointer, or buffer used during codec processing - is read before being assigned a defined value, allowing an attacker to influence its contents from a prior allocation. Because codec data crosses trust boundaries via Mojo IPC, controllable uninitialized state can be leveraged to corrupt higher-privileged process logic or leak pointers used to defeat ASLR, enabling escape from the renderer sandbox to the browser process.

RemediationAI

Update Chrome to version 149.0.7827.53 or later via the Stable channel (Vendor-released patch: 149.0.7827.53) per https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html; on managed fleets, force restart of the browser to ensure the new binary is loaded since Chrome only completes updates on relaunch. For Chromium-based browsers, apply the equivalent vendor build once published (monitor Edge, Brave, Opera, Vivaldi advisories) and update Electron-based desktop apps to a Chromium 149+ runtime. As compensating controls until patching, enforce Site Isolation (already default but verifiable via chrome://flags), disable unnecessary codec/media features in enterprise policy where feasible (trade-off: breaks legitimate media playback), and restrict browsing to trusted sites via enterprise URL allowlists for high-risk users - generic 'block all media' is not practical for most environments.