What is the CVSS score of CVE-2026-10970?

CVE-2026-10970 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-10970?

Google Chrome versions prior to 149.0.7827.53 contain a sandbox escape vulnerability (CVE-2026-10970, CVSS 8.3) that allows attackers with access to the browser's renderer process to break the…. A patch is available.

How to fix or mitigate CVE-2026-10970?

Within 24 hours: Identify all systems running Chrome versions prior to 149.0.7827.53 and classify by criticality. Within 7 days: Deploy Chrome 149.0.7827.53 or later to test and staging environments; validate application functionality and user workflows. Within 30 days: Complete staged rollout of Chrome 149.0.7827.53 or later to all user endpoints; enforce automatic updates via group policy (Windows) or mobile device management to prevent version regression.

Google Chrome CVE-2026-10970

EUVD-2026-34419 HIGH

Improper Input Validation (CWE-20)

2026-06-04 chrome-cve-admin@google.com

GHSA-33cg-9xrv-3cmx

Information Disclosure Google

8.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.0 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 02:56 vuln.today

CVSS changed

Jun 05, 2026 - 02:22 NVD

8.3 (HIGH)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

HIGH 8.3

DescriptionCVE.org

Insufficient validation of untrusted input in InterestGroups in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome versions prior to 149.0.7827.53 allows a remote attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page abusing the InterestGroups component. Google rates the Chromium severity as High, and CVSS scores it 8.3 with a changed scope reflecting the cross-boundary impact. No public exploit identified at time of analysis, though a vendor patch is available.

Technical ContextAI

The flaw resides in Chromium's InterestGroups implementation, the browser-side component supporting the Protected Audience (FLEDGE/TURTLEDOVE) Privacy Sandbox API used for on-device interest-based ad auctions. The root cause is CWE-20 (Improper Input Validation): the privileged browser process fails to sufficiently validate data received from the less-trusted renderer process, which is normally constrained by the Chromium sandbox. By feeding malformed InterestGroup-related input across this IPC boundary, an attacker controlling the renderer can influence higher-privileged code paths to escape sandbox confinement.

RemediationAI

Vendor-released patch: upgrade Chrome to 149.0.7827.53 or later on all desktop platforms via the standard auto-update channel, then restart the browser to load the new binary, as announced at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Enterprise fleets should force-push the update through Chrome Browser Cloud Management or equivalent endpoint management and verify the version with chrome://version. For downstream Chromium browsers (Edge, Brave, Opera, Vivaldi), apply the vendor's corresponding rebased release as soon as it is published. As a temporary compensating control until patching, administrators can disable the Privacy Sandbox / Protected Audience APIs via the PrivacySandboxAdsAPIsEnabled and related enterprise policies, which removes the vulnerable InterestGroups attack surface at the cost of breaking interest-based ad auction functionality for sites that rely on it; this does not protect against unrelated renderer bugs that could still be chained with other escapes.