What is the CVSS score of CVE-2026-10974?

CVE-2026-10974 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-10974?

Google Chrome versions prior to 149.0.7827.53 contain a critical sandbox escape vulnerability in the ANGLE graphics layer that permits remote code execution when users visit malicious websites,…. A patch is available.

How to fix or mitigate CVE-2026-10974?

24 hours: Inventory all Chrome deployments across endpoints and identify systems running versions prior to 149.0.7827.53; communicate patch requirement to business units. 7 days: Deploy Chrome 149.0.7827.53 or later organization-wide; prioritize systems with administrative users or access to sensitive data. 30 days: Verify deployment compliance through endpoint telemetry; review logs for sandbox escape exploitation attempts or suspicious renderer process behavior predating patch deployment.

Google Chrome CVE-2026-10974

EUVD-2026-34423 CRITICAL

Improper Input Validation (CWE-20)

2026-06-04 chrome-cve-admin@google.com

GHSA-54jj-j82p-3258

Information Disclosure Google

9.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 20:23 vuln.today

CVSS changed

Jun 05, 2026 - 20:22 NVD

9.6 (CRITICAL)

CVSS changed

Jun 05, 2026 - 20:22 NVD

9.6 (CRITICAL)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

CRITICAL 9.6

DescriptionNVD

Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome's ANGLE graphics layer prior to version 149.0.7827.53 allows a remote attacker to break out of the renderer sandbox via a crafted HTML page when a victim visits a malicious site. The flaw is rated CVSS 9.6 due to scope change (S:C) and full CIA impact, though EPSS estimates only a 0.05% near-term exploitation probability and no public exploit has been identified at time of analysis.

Technical ContextAI

ANGLE (Almost Native Graphics Layer Engine) is the translation layer Chrome uses to map WebGL and other graphics API calls onto the host platform's native graphics stack (Direct3D on Windows, Metal on macOS, Vulkan/OpenGL on Linux). Because ANGLE processes complex, attacker-controllable graphics commands from web content, it is a frequent target for sandbox escapes. The root cause is CWE-20 (Improper Input Validation): untrusted input from a crafted HTML page is not sufficiently validated before being processed by ANGLE, enabling the renderer process to violate the boundaries the Chrome sandbox is designed to enforce.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 - update Chrome via the built-in updater (chrome://settings/help) and restart the browser, per the stable channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html and the upstream bug tracker entry at https://issues.chromium.org/issues/513135862. For managed fleets, push the update via Chrome Browser Cloud Management, Group Policy, or MDM and verify the version post-deployment. As a temporary compensating control until patching completes, administrators can disable WebGL/GPU acceleration via the DisableWebGL or HardwareAccelerationModeEnabled enterprise policies to reduce ANGLE's attack surface, with the trade-off that WebGL-based applications (maps, 3D dashboards, some video conferencing effects) will degrade or break; users of Chromium-derivative browsers (Edge, Brave, Opera, Vivaldi) should update to the vendor build that incorporates the patched Chromium baseline.