What is the CVSS score of CVE-2026-10972?

CVE-2026-10972 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-10972?

Google Chrome on Linux users are at risk from a critical vulnerability (CVE-2026-10972) that allows remote attackers to gain system-level access by exploiting a browser flaw.. A patch is available.

How to fix or mitigate CVE-2026-10972?

Within 24 hours: Inventory Chrome deployments across endpoints and development environments, particularly on Linux systems. Within 7 days: Deploy Google Chrome 149.0.7827.53 or later across all affected systems, prioritizing user-facing endpoints. Within 30 days: Validate patch deployment via browser version reporting and confirm no systems remain on affected versions.

Google Chrome CVE-2026-10972

EUVD-2026-34421 CRITICAL

Use After Free (CWE-416)

2026-06-04 chrome-cve-admin@google.com

GHSA-fx2r-gfq7-r5p3

Denial Of Service Google Use After Free Memory Corruption

9.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 20:39 vuln.today

CVSS changed

Jun 05, 2026 - 20:37 NVD

9.6 (CRITICAL)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

CRITICAL 9.6

DescriptionNVD

Use after free in Ozone in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome on Linux prior to 149.0.7827.53 allows a remote attacker to break out of the renderer process by luring a user to a crafted HTML page that triggers a use-after-free in the Ozone display/windowing layer. Google rates the underlying Chromium issue as High severity and a vendor patch is available; no public exploit identified at time of analysis and the EPSS score is very low (0.03%).

Technical ContextAI

Ozone is Chromium's platform abstraction layer for windowing, input, and graphics on Linux (Wayland, X11, DRM/GBM); it sits inside the browser/GPU process boundary that the renderer sandbox is meant to constrain. CWE-416 (Use After Free) indicates an object in Ozone is freed but a dangling pointer is subsequently dereferenced, letting an attacker who already controls a compromised renderer (via the crafted HTML page) corrupt memory in a more privileged process and thereby escape the sandbox. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* and the EUVD constraint 'Chrome 149.0.7827.53 <149.0.7827.53' scope the flaw to Chrome on Linux only.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 for Linux - upgrade all Linux Chrome installs to 149.0.7827.53 or later via the Stable channel and restart the browser to apply, per the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html (issue https://issues.chromium.org/issues/513006660). No vendor-supplied configuration workaround is documented; until patching, compensating controls that meaningfully reduce risk include enforcing Chrome auto-update via enterprise policy, restricting browsing of untrusted sites through a web proxy/URL allowlist (trade-off: blocks legitimate user browsing), and running Chrome under an additional OS-level sandbox such as bubblewrap/firejail or as an unprivileged user inside a hardened container (trade-off: may break GPU acceleration, file pickers, or extensions that rely on Ozone/Wayland integration).