What is the CVSS score of CVE-2026-10975?

CVE-2026-10975 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-10975?

Google Chrome versions prior to 149.0.7827.53 contain a high-severity remote code execution vulnerability (CVE-2026-10975) exploitable by unauthenticated attackers through specially crafted websites.. A patch is available.

How to fix or mitigate CVE-2026-10975?

Within 24 hours: assess Chrome deployment scope and ensure auto-updates are enabled. Within 7 days: deploy Chrome 149.0.7827.53 or later organization-wide through your patch management system. Within 30 days: verify 100% patching completion and confirm vulnerable versions are no longer present in the environment.

Google Chrome CVE-2026-10975

EUVD-2026-34424 HIGH

Use After Free (CWE-416)

2026-06-04 chrome-cve-admin@google.com

GHSA-c282-rr9w-v6rm

Google Memory Corruption RCE Use After Free Denial Of Service Red Hat Suse Chrome

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 02:56 vuln.today

CVSS changed

Jun 05, 2026 - 02:22 NVD

8.8 (HIGH)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in WebRTC in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome versions prior to 149.0.7827.53 stems from a use-after-free flaw in the WebRTC component, enabling a remote attacker to execute arbitrary code inside the renderer sandbox by luring a victim to a crafted HTML page. The issue is rated High severity by Chromium and carries a CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:N/UI:R), reflecting low complexity and no privilege requirement but requiring user interaction. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.

Technical ContextAI

The flaw is a CWE-416 Use-After-Free defect in Chrome's WebRTC implementation, the real-time communication stack responsible for peer-to-peer audio, video, and data channels exposed to JavaScript via APIs such as RTCPeerConnection and RTCDataChannel. Use-after-free occurs when memory is reclaimed while a dangling pointer still references it, allowing controlled reuse to corrupt object vtables or function pointers and divert execution. Because WebRTC is reachable from any web page without explicit user permission for some sub-APIs and is implemented in C++ within the renderer process, such bugs are a recurring target for exploit developers. Per the EUVD data the affected component is the Chromium browser binary at versions earlier than 149.0.7827.53; no formal CPE strings were supplied in this intelligence package.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 or later on the Stable desktop channel - update via Chrome's built-in updater (Settings > About Chrome) and restart the browser, then verify the version string. Enterprise administrators should push the new build via Google Update / Chrome Browser Cloud Management or their MDM tooling and audit Chromium-derived browsers and Electron apps for upstream Chromium roll-ups, referencing https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html and the tracker at https://issues.chromium.org/issues/513154132. Where immediate patching is not possible, compensating controls include enforcing Site Isolation (default on desktop) to keep the WebRTC renderer compromise per-origin, restricting WebRTC via the WebRtcAllowLegacyTLSProtocols/WebRtcUdpPortRange enterprise policies or disabling WebRTC entirely via the URLBlocklist policy on browsers that do not require voice/video calling, and blocking outbound STUN/TURN (UDP 3478, TCP/UDP 19302) at the egress firewall for non-conferencing endpoints - note these controls will break Google Meet, Zoom Web, Teams calls, and other RTC features.