What is the CVSS score of CVE-2026-10971?

CVE-2026-10971 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-10971?

Google Chrome on Windows contains a critical sandbox escape vulnerability (CVE-2026-10971) that could allow attackers who have compromised the browser process to gain unauthorized system-level…. A patch is available.

How to fix or mitigate CVE-2026-10971?

Within 24 hours: Inventory all Windows systems running Google Chrome versions prior to 149.0.7827.53 and flag for expedited patching. Within 7 days: Deploy Chrome 149.0.7827.53 or later across all Windows endpoints through your standard browser update mechanism. Within 30 days: Verify patch compliance via endpoint management tools and document deployment completion.

Google Chrome CVE-2026-10971

EUVD-2026-34420 CRITICAL

Improper Input Validation (CWE-20)

2026-06-04 chrome-cve-admin@google.com

GHSA-fpw8-fw44-c744

Information Disclosure Google Microsoft

9.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

9.0 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 20:39 vuln.today

CVSS changed

Jun 05, 2026 - 20:37 NVD

9.6 (CRITICAL)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

CRITICAL 9.6

DescriptionNVD

Insufficient validation of untrusted input in Printing in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome on Windows prior to 149.0.7827.53 allows a remote attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page abusing the Printing component. Chromium rates the issue High severity and a vendor patch is available, though no public exploit has been identified at time of analysis and EPSS remains very low at 0.05%.

Technical ContextAI

The flaw resides in Chrome's Printing component on Windows, which handles print preview, PDF generation and the IPC bridge between the sandboxed renderer and the more privileged browser process. The root cause is CWE-20 (Improper Input Validation): the Printing code accepts data crossing the renderer-to-browser trust boundary without sufficient validation, enabling logic in the higher-privileged process to be manipulated. Because Chrome's sandbox model assumes the renderer is hostile, any insufficient validation on this IPC surface can be chained from an initial renderer compromise to escape the sandbox onto the host. Affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* limited to the Windows build per the description.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 for Windows on the Stable channel - update immediately via Chrome's built-in updater or push the MSI through your endpoint management tooling, then force a browser relaunch so the new binary is loaded. The vendor advisory is at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html and the Chromium tracker at https://issues.chromium.org/issues/513005991. As compensating controls until patches roll out, consider disabling Chrome's print preview/printing via the PrintingEnabled enterprise policy (trade-off: end users lose in-browser printing and must use OS-level workflows), restricting which sites can run script via the URLBlocklist/URLAllowlist policies to reduce exposure to drive-by renderer exploitation that would be needed as the first link in the chain, and ensuring Site Isolation and the renderer sandbox are not weakened by --no-sandbox or similar flags in managed deployments.