What is the CVSS score of CVE-2026-10964?

CVE-2026-10964 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-10964?

Google Chrome versions before 149.0.7827.53 are vulnerable to remote code execution through the V8 JavaScript engine; while no public exploit has been identified at time of analysis, attackers can…. A patch is available.

How to fix or mitigate CVE-2026-10964?

Within 24 hours: inventory all managed Chrome deployments and confirm your patch distribution mechanism is operational. Within 7 days: deploy Chrome 149.0.7827.53 or later across all endpoints via your standard patch management process. Within 30 days: complete a patch compliance audit using endpoint management tools or browser telemetry to verify 100% of Chrome instances are running version 149.0.7827.53 or later.

Google Chrome CVE-2026-10964

EUVD-2026-34413 HIGH

External Control of Assumed-Immutable Web Parameter (CWE-472)

2026-06-04 chrome-cve-admin@google.com

GHSA-52pc-9jv4-4m3g

Google RCE Red Hat Suse Chrome

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 02:54 vuln.today

CVSS changed

Jun 05, 2026 - 02:22 NVD

8.8 (HIGH)

CVE Published

Jun 04, 2026 - 23:16 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:16 nvd

HIGH 8.8

DescriptionCVE.org

Integer overflow in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome versions prior to 149.0.7827.53 stems from an integer overflow in the V8 JavaScript engine, enabling a remote attacker to execute arbitrary code within the renderer sandbox via a crafted HTML page. The flaw is rated High severity by Chromium with a CVSS score of 8.8, requires user interaction (visiting a malicious page), and no public exploit has been identified at time of analysis. While exploitation is sandboxed, V8 RCE bugs historically chain with sandbox escapes to achieve full host compromise, making this a priority patch for browser fleets.

Technical ContextAI

V8 is the open-source JavaScript and WebAssembly engine that powers Chrome, Chromium-based browsers (Edge, Opera, Brave), and Node.js. The root cause maps to CWE-472 (External Control of Assumed-Immutable Web Parameter); however, the description explicitly identifies an integer overflow, a class of arithmetic boundary error (more typically CWE-190) where a calculation exceeds the range of its integer type, producing wrap-around values that can corrupt heap metadata, lead to undersized buffer allocations, and ultimately enable out-of-bounds reads/writes and type confusion within V8's optimizing compiler or runtime. Successful exploitation yields code execution in the renderer process, which is constrained by Chrome's site isolation and OS-level sandboxing, but a fully weaponized chain typically pairs a V8 bug with a separate sandbox escape.

RemediationAI

Vendor-released patch: update Google Chrome to 149.0.7827.53 or later via the Chrome stable channel update referenced at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html; managed deployments should force-update via group policy, MDM, or Chrome Browser Cloud Management and verify rollout. Audit and update Chromium-derivative browsers (Edge, Brave, Opera, Vivaldi) and any Electron/CEF-embedded applications once their respective vendors ship rebases. If patching cannot occur immediately, compensating controls include disabling JavaScript on untrusted sites via Site Settings or enterprise policy (DefaultJavaScriptSetting), restricting browsing to a curated allowlist (URLBlocklist/URLAllowlist policies), enabling Chrome's Site Isolation if not already on, and blocking known malvertising/exploit-kit infrastructure at the proxy or DNS layer - note that disabling JavaScript globally will break most modern web applications and is typically only viable for high-risk users or kiosks.