What is the CVSS score of CVE-2026-10963?

CVE-2026-10963 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-10963?

Google Chrome's V8 JavaScript engine contains a remote code execution vulnerability affecting all versions prior to 149.0.7827.53 that allows attackers to execute arbitrary code in the browser…. A patch is available.

How to fix or mitigate CVE-2026-10963?

Within 24 hours: Inventory all Chrome installations across managed endpoints and assess deployment infrastructure. Within 7 days: Deploy Google Chrome 149.0.7827.53 or later to all endpoints using mobile device management, group policy, or organizational deployment tools; prioritize systems with unrestricted internet access. Within 30 days: Verify patch compliance via endpoint management dashboards and audit logs; monitor threat intelligence feeds for exploitation attempts.

Google Chrome CVE-2026-10963

EUVD-2026-34412 HIGH

External Control of Assumed-Immutable Web Parameter (CWE-472)

2026-06-04 chrome-cve-admin@google.com

GHSA-pwmv-qpch-986c

RCE Google

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 02:54 vuln.today

CVSS changed

Jun 05, 2026 - 02:22 NVD

8.8 (HIGH)

CVE Published

Jun 04, 2026 - 23:16 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:16 nvd

HIGH 8.8

DescriptionCVE.org

Integer overflow in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome's V8 JavaScript engine prior to version 149.0.7827.53 allows a remote attacker to execute arbitrary code within the renderer sandbox by luring a victim to a crafted HTML page. Google has rated the issue High severity and shipped a stable-channel patch; no public exploit has been identified at time of analysis, and the bug tracker entry remains access-restricted per Chromium's standard disclosure practice.

Technical ContextAI

V8 is the open-source JavaScript and WebAssembly engine that powers Chrome and Chromium-derived browsers (Edge, Opera, Brave, Electron apps). The flaw is classified as CWE-472 (External Control of Assumed-Immutable Web Parameter), but the description specifically identifies an integer overflow - a numeric value exceeding the range of its declared type - within V8's processing of attacker-controlled JavaScript. Integer overflows in V8 typically corrupt internal length, offset, or type fields used by JIT-compiled code or built-in objects, enabling out-of-bounds memory access that can be escalated to arbitrary read/write and ultimately code execution inside the renderer process. Per the vendor wording, execution remains 'inside a sandbox,' meaning a separate sandbox-escape vulnerability would be required to reach the host OS.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 - update the stable channel via the built-in updater or by relaunching Chrome from chrome://settings/help, and confirm rollout via Google Admin Console or your endpoint management platform; details are in the Chrome Releases advisory at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html and NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-10963. For Chromium-derived browsers (Edge, Brave, Opera, Vivaldi) and Electron applications, apply the corresponding downstream build that incorporates the fixed V8. As a temporary compensating control where patching is delayed, disable the V8 JIT optimizer via the --js-flags="--jitless" command-line flag or the SitePerProcess/JavaScriptJitAllowedForSites enterprise policies, which significantly reduces the attack surface of V8 memory-corruption bugs at the cost of substantial JavaScript performance degradation; alternatively, restrict browsing to trusted sites via enterprise URL allowlists until the update is deployed.