What is the CVSS score of CVE-2026-10961?

CVE-2026-10961 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome iOS are affected by CVE-2026-10961?

Google Chrome for iOS users are exposed to a privilege escalation vulnerability (CVE-2026-10961, CVSS 8.3) that allows attackers to escape browser sandboxing protections following an initial renderer…. A patch is available.

How to fix or mitigate CVE-2026-10961?

Within 24 hours: Identify Chrome for iOS usage across your organization using your MDM or device inventory system. Within 7 days: Distribute update requirement to version 149.0.7827.53 or later through internal channels, prioritizing users with access to sensitive data or systems. Within 30 days: Verify at least 95% compliance with the patch; enforce Chrome version gating on sensitive corporate Wi-Fi networks for non-compliant devices.

Google Chrome iOS CVE-2026-10961

EUVD-2026-34410 HIGH

Use After Free (CWE-416)

2026-06-04 chrome-cve-admin@google.com

GHSA-pwcr-2jqr-8f3x

Google Memory Corruption Apple Use After Free Denial Of Service Suse Chrome Red Hat

8.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 02:53 vuln.today

CVSS changed

Jun 05, 2026 - 02:22 NVD

8.3 (HIGH)

CVE Published

Jun 04, 2026 - 23:16 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:16 nvd

HIGH 8.3

DescriptionCVE.org

Use after free in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome for iOS before 149.0.7827.53 allows a remote attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page exploiting a use-after-free condition. The flaw is rated High severity by Chromium and has a CVSS score of 8.3, but no public exploit has been identified at time of analysis and it is not listed in CISA KEV. Successful exploitation typically requires chaining with a separate renderer-compromise primitive, raising the practical bar.

Technical ContextAI

The vulnerability is a CWE-416 Use-After-Free in Chrome for iOS, the WebKit-backed Google-branded browser on Apple's mobile platform. Use-after-free bugs occur when freed heap memory is dereferenced through a dangling pointer, allowing an attacker who controls heap layout to redirect execution or corrupt object state. On iOS, Chrome must use Apple's WebKit engine per App Store policy, so the bug lives in Chrome-specific glue code rather than Blink, and the 'sandbox' being escaped is the iOS-level process sandbox surrounding the renderer.

RemediationAI

Vendor-released patch: Google Chrome for iOS 149.0.7827.53 - upgrade via the Apple App Store, which is the only supported distribution channel. Enterprises managing iOS fleets via MDM should push an app update policy to force Chrome to the fixed build and verify installation through their MDM inventory. No vendor-supplied workarounds are published; if patching is delayed, compensating controls include steering users to Safari (which is not affected by this CVE), restricting Chrome on iOS via MDM app blocklists, or instructing users to avoid untrusted links until updated - each trades off browser choice and user friction against residual risk. Reference Google's advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html and the Chromium issue at https://issues.chromium.org/issues/508281950 once details become public.