What is the CVSS score of CVE-2026-10962?

CVE-2026-10962 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-10962?

Google Chrome before version 149.0.7827.53 contains a remote code execution vulnerability triggered when users visit malicious websites.. A patch is available.

How to fix or mitigate CVE-2026-10962?

Within 24 hours: Audit Chrome versions deployed across all endpoints to identify affected systems. Within 7 days: Deploy Google Chrome 149.0.7827.53 or later organization-wide via standard patch management; enable automatic updates where supported. Within 30 days: Verify complete patch deployment across all systems and confirm no instances of vulnerable versions remain active.

Google Chrome CVE-2026-10962

EUVD-2026-34411 HIGH

Access of Resource Using Incompatible Type (Type Confusion) (CWE-843)

2026-06-04 chrome-cve-admin@google.com

GHSA-c736-4v3x-hr9q

RCE Google Memory Corruption

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 02:53 vuln.today

CVSS changed

Jun 05, 2026 - 02:22 NVD

8.8 (HIGH)

CVE Published

Jun 04, 2026 - 23:16 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:16 nvd

HIGH 8.8

DescriptionCVE.org

Type Confusion in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome before 149.0.7827.53 allows a remote attacker to execute arbitrary code inside the renderer sandbox by luring a user to a crafted HTML page that triggers a type confusion in the Media component. The flaw carries a CVSS 8.8 (High) rating and requires user interaction (visiting a page), and while no public exploit has been identified at time of analysis, Chromium-rated High Media bugs have historically been chained with sandbox escapes for full compromise.

Technical ContextAI

The vulnerability is a CWE-843 (Access of Resource Using Incompatible Type, or 'type confusion') flaw in Chrome's Media subsystem, which handles parsing and playback of audio/video content embedded in HTML pages. Type confusion occurs when code interprets memory as one object type while it actually holds another, enabling attackers to read or write outside the intended object layout and ultimately hijack control flow. Chromium's Media stack processes complex container/codec data from the network, making it a frequently targeted attack surface; exploitation here yields code execution within the renderer sandbox process per the advisory wording.

RemediationAI

Vendor-released patch: update Google Chrome to 149.0.7827.53 or later on all desktop platforms via the Stable channel auto-updater, then restart the browser to load the new binary (auto-update will not apply until the process restarts). The vendor advisory is https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Enterprise fleets should push the update via Chrome Browser Cloud Management or their endpoint management system and verify chrome://version on a sample of hosts. If patching must be delayed, compensating controls include disabling autoplay and using the SitePerProcess and StrictOriginIsolation enterprise policies to harden the renderer sandbox boundary, blocking access to untrusted sites via web proxy/DNS filtering, and instructing users to avoid clicking unsolicited links - trade-offs are user friction and incomplete coverage, since any HTML page rendered (including ads) can deliver the exploit. Users of Chromium-based browsers (Edge, Brave, Opera, Vivaldi) should update once their vendor ships the merged fix.