What is the CVSS score of CVE-2026-10966?

CVE-2026-10966 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-10966?

A critical vulnerability in Google Chrome versions prior to 149.0.7827.53 allows attackers to achieve complete system compromise when users visit malicious web pages containing specially crafted…. A patch is available.

How to fix or mitigate CVE-2026-10966?

24 hours: Assess Chrome deployment scope and identify high-risk user populations (executives, developers, researchers). 7 days: Deploy Chrome version 149.0.7827.53 or later across all endpoints using configuration management systems and verify coverage reaches at least 80% of installed base. 30 days: Achieve 100% patch compliance, update browser security policies to enforce automatic updates, and disable unsupported legacy Chrome versions.

Google Chrome CVE-2026-10966

EUVD-2026-34415 CRITICAL

Improper Input Validation (CWE-20)

2026-06-04 chrome-cve-admin@google.com

GHSA-rg7g-8w6w-cjj6

Information Disclosure Google

9.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 20:37 vuln.today

CVSS changed

Jun 05, 2026 - 20:37 NVD

9.6 (CRITICAL)

CVE Published

Jun 04, 2026 - 23:16 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:16 nvd

CRITICAL 9.6

DescriptionNVD

Inappropriate implementation in Codecs in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted video file. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome versions prior to 149.0.7827.53 allows remote attackers to break out of the renderer process sandbox by delivering a crafted video file processed by the browser's codec implementation. The CVSS 9.6 score reflects a scope-changing impact across confidentiality, integrity, and availability, though exploitation requires user interaction such as visiting a malicious page. No public exploit identified at time of analysis, and EPSS exploitation probability remains low at 0.05%.

Technical ContextAI

The flaw resides in Chrome's media Codecs subsystem, which decodes container and stream formats inside the browser process boundary. The CWE-20 (Improper Input Validation) classification indicates that the codec parser fails to properly validate malformed or attacker-controlled fields within a video file, and the resulting condition is reachable from the sandboxed renderer in a way that allows escaping into a more privileged process. Chromium's multi-process architecture treats a sandbox escape as one of the most severe categories because it bypasses the primary containment boundary protecting the host operating system. The affected component is identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* across all platforms shipping the desktop Stable channel.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 - upgrade the Stable channel immediately on Windows, macOS, and Linux endpoints per the advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html, and force-relaunch via enterprise policy (RelaunchNotification / RelaunchNotificationPeriod) to ensure the running process actually picks up the fix. Administrators of Chromium-derived browsers should track and apply the equivalent vendor build as soon as it is published. Until patching completes, compensating controls include disabling autoplay of media via the AutoplayAllowed=false policy and restricting risky media MIME types at the web proxy, which reduces drive-by exposure but does not eliminate risk when users intentionally click crafted content; blocking untrusted sites at the DNS/proxy layer (e.g., a strict allowlist) is more effective but operationally disruptive. Reference the EUVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-10966 and chromium issue https://issues.chromium.org/issues/511713779 for tracking.