What is the CVSS score of CVE-2026-10967?

CVE-2026-10967 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-10967?

Google Chrome for Android prior to version 149.0.7827.53 contains a high-severity privilege escalation vulnerability that allows attackers to escape the browser sandbox and potentially compromise…. A patch is available.

How to fix or mitigate CVE-2026-10967?

Within 24 hours: Identify all Android devices running Chrome through your MDM platform or device inventory system. Within 7 days: Push Chrome update to version 149.0.7827.53 or later to all affected devices. Within 30 days: Verify patch deployment completion and confirm no vulnerable Chrome versions remain in your environment.

Google Chrome CVE-2026-10967

EUVD-2026-34416 HIGH

Use After Free (CWE-416)

2026-06-04 chrome-cve-admin@google.com

GHSA-hmm3-9xrq-9frc

Denial Of Service Use After Free Memory Corruption Google Red Hat Suse Chrome

8.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.0 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 02:55 vuln.today

CVSS changed

Jun 05, 2026 - 02:22 NVD

8.3 (HIGH)

CVE Published

Jun 04, 2026 - 23:16 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:16 nvd

HIGH 8.3

DescriptionCVE.org

Use after free in SurfaceCapture in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome on Android prior to 149.0.7827.53 allows a remote attacker who has already compromised the renderer process to break out of the Chrome sandbox via a crafted HTML page that triggers a use-after-free in the SurfaceCapture component. The flaw is rated High severity by Chromium and carries a CVSS 3.1 score of 8.3 with scope change, reflecting that successful exploitation crosses the renderer/browser security boundary. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

SurfaceCapture is the Chromium component responsible for capturing visual output from rendering surfaces (used by features such as tab/window/screen capture and getDisplayMedia). The root cause is CWE-416 (Use After Free): code paths in SurfaceCapture retain or dereference a pointer to a memory object after it has been freed, allowing memory contents under attacker influence to be reinterpreted as a valid object. Because SurfaceCapture logic runs in the browser/GPU process boundary that the sandboxed renderer interacts with via IPC, a corrupted-renderer-driven use-after-free here yields code execution outside the renderer sandbox, escalating from an in-renderer compromise to higher-privileged process context on Android. This is the classic second stage in a Chrome exploit chain, paired with an earlier renderer RCE bug.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 for Android - update Chrome via Google Play to this version or later, per the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. For managed Android fleets, push the update through MDM and verify rollout via Play managed configurations. As an interim compensating control where patching is delayed, restrict use of features that exercise SurfaceCapture (screen, tab, or window capture via getDisplayMedia / chrome.desktopCapture) using enterprise policies such as ScreenCaptureAllowed=false and ScreenCaptureAllowedByOrigins, with the trade-off that web conferencing and remote-support sites that rely on screen sharing will break; this does not fully eliminate exposure because the renderer compromise that precedes this bug may come from any web content. Avoid browsing untrusted sites on unpatched devices and ensure Android system WebView and OS security patches are also current.