What is the CVSS score of CVE-2026-10972?

CVE-2026-10972 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-10972?

Google Chrome on Linux users are at risk from a critical vulnerability (CVE-2026-10972) that allows remote attackers to gain system-level access by exploiting a browser flaw.. A patch is available.

How to fix or mitigate CVE-2026-10972?

Within 24 hours: Inventory Chrome deployments across endpoints and development environments, particularly on Linux systems. Within 7 days: Deploy Google Chrome 149.0.7827.53 or later across all affected systems, prioritizing user-facing endpoints. Within 30 days: Validate patch deployment via browser version reporting and confirm no systems remain on affected versions.

Google Chrome CVE-2026-10972

EUVD-2026-34421 CRITICAL

Use After Free (CWE-416)

2026-06-04 chrome-cve-admin@google.com

GHSA-fx2r-gfq7-r5p3

Denial Of Service Use After Free Memory Corruption Google Chrome

9.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 20:39 vuln.today

CVSS changed

Jun 05, 2026 - 20:37 NVD

9.6 (CRITICAL)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

CRITICAL 9.6

DescriptionCVE.org

Use after free in Ozone in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome on Linux prior to 149.0.7827.53 allows a remote attacker to break out of the renderer process by luring a user to a crafted HTML page that triggers a use-after-free in the Ozone display/windowing layer. Google rates the underlying Chromium issue as High severity and a vendor patch is available; no public exploit identified at time of analysis and the EPSS score is very low (0.03%).

Technical ContextAI

Ozone is Chromium's platform abstraction layer for windowing, input, and graphics on Linux (Wayland, X11, DRM/GBM); it sits inside the browser/GPU process boundary that the renderer sandbox is meant to constrain. CWE-416 (Use After Free) indicates an object in Ozone is freed but a dangling pointer is subsequently dereferenced, letting an attacker who already controls a compromised renderer (via the crafted HTML page) corrupt memory in a more privileged process and thereby escape the sandbox. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* and the EUVD constraint 'Chrome 149.0.7827.53 <149.0.7827.53' scope the flaw to Chrome on Linux only.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 for Linux - upgrade all Linux Chrome installs to 149.0.7827.53 or later via the Stable channel and restart the browser to apply, per the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html (issue https://issues.chromium.org/issues/513006660). No vendor-supplied configuration workaround is documented; until patching, compensating controls that meaningfully reduce risk include enforcing Chrome auto-update via enterprise policy, restricting browsing of untrusted sites through a web proxy/URL allowlist (trade-off: blocks legitimate user browsing), and running Chrome under an additional OS-level sandbox such as bubblewrap/firejail or as an unprivileged user inside a hardened container (trade-off: may break GPU acceleration, file pickers, or extensions that rely on Ozone/Wayland integration).