What is the CVSS score of CVE-2026-10973?

CVE-2026-10973 has a CVSS 3.1 base score of 7.4 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N. EPSS exploitation probability: 1.6%.

Which versions of Google Chrome are affected by CVE-2026-10973?

Google Chrome prior to version 149.0.7827.53 contains a cross-origin data leakage vulnerability in the WebGPU implementation that could expose sensitive user data when a user visits a malicious…. A patch is available.

How to fix or mitigate CVE-2026-10973?

Within 24 hours: Identify all Chrome deployments across the organization and establish an emergency patching timeline. Within 7 days: Deploy Google Chrome version 149.0.7827.53 or later to all systems, prioritizing user-facing machines and administrative workstations. Within 30 days: Verify 100% compliance with minimum version 149.0.7827.53, conduct spot audits of deployed versions, and document remediation completion.

Google Chrome CVE-2026-10973

EUVD-2026-34422 HIGH

Use of Uninitialized Variable (CWE-457)

2026-06-04 chrome-cve-admin@google.com

GHSA-5q46-3pcm-3mxv

Information Disclosure Google Chrome

7.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

SUSE

HIGH

qualitative

Red Hat

6.5 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 20:40 vuln.today

CVSS changed

Jun 05, 2026 - 20:37 NVD

7.4 (HIGH)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

HIGH 7.4

DescriptionCVE.org

Uninitialized Use in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Cross-origin data leakage in Google Chrome's Dawn WebGPU implementation prior to version 149.0.7827.53 allows a remote attacker to read sensitive data from other origins by luring a user to a crafted HTML page. Chromium rates this High severity and a vendor patch is available, though no public exploit has been identified at time of analysis and EPSS places exploitation probability at 1.64% (82nd percentile).

Technical ContextAI

Dawn is Chromium's open-source, cross-platform implementation of the WebGPU API, which exposes GPU compute and rendering capabilities to web content through a JavaScript interface. The root cause is CWE-457 (Use of Uninitialized Variable): a code path inside Dawn reads memory that was never initialized, allowing residual contents - potentially populated by data from other origins or processes - to be returned to the attacker-controlled page. Because WebGPU operates close to the GPU driver and shares GPU memory across browser tabs and renderers, uninitialized reads here are especially dangerous for breaking the same-origin policy. Affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering Chrome desktop builds preceding 149.0.7827.53.

RemediationAI

Vendor-released patch: update Google Chrome to 149.0.7827.53 or later on all desktop platforms, as documented in the Stable Channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. For managed fleets, push the update via Chrome Browser Cloud Management or your endpoint management tooling and verify chrome://settings/help reports the fixed build; ensure downstream Chromium-based browsers (Edge, Brave, Opera, Electron apps) are upgraded to releases that incorporate the Dawn fix. If immediate patching is not possible, a targeted compensating control is to disable WebGPU by launching Chrome with --disable-features=WebGPU or via enterprise policy, which closes the affected Dawn attack surface at the cost of breaking WebGPU-dependent sites and applications (rare today, more common for ML demos and some games); blocking known malicious domains at the proxy layer is a weaker secondary mitigation since exploitation only requires visiting attacker-controlled HTML.