What is the CVSS score of CVE-2026-10976?

CVE-2026-10976 has a CVSS 3.1 base score of 7.4 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-10976?

Google Chrome versions prior to 149.0.7827.53 contain an information disclosure vulnerability in the WebGPU subsystem that allows remote attackers to leak sensitive process memory through malicious…. A patch is available.

How to fix or mitigate CVE-2026-10976?

Within 24 hours: Inventory all systems running Google Chrome versions prior to 149.0.7827.53 and assess user impact scope. Within 7 days: Deploy Google Chrome 149.0.7827.53 or later via your update management infrastructure, prioritizing endpoints with access to sensitive applications or data. Within 30 days: Confirm patch deployment across the organization and validate no instances of vulnerable versions remain in active use.

Google Chrome CVE-2026-10976

EUVD-2026-34425 HIGH

Use of Uninitialized Variable (CWE-457)

2026-06-04 chrome-cve-admin@google.com

GHSA-mx4h-4m2f-fwrr

Information Disclosure Google

7.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

SUSE

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Red Hat

6.5 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 20:24 vuln.today

CVSS changed

Jun 05, 2026 - 20:22 NVD

7.4 (HIGH)

CVSS changed

Jun 05, 2026 - 20:22 NVD

7.4 (HIGH)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

HIGH 7.4

DescriptionNVD

Uninitialized Use in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Information disclosure in Google Chrome versions prior to 149.0.7827.53 allows remote attackers to leak sensitive process memory through a crafted HTML page that triggers an uninitialized memory read in the Dawn WebGPU implementation. Google rates the underlying Chromium issue as High severity, and a patched stable channel build is available, though no public exploit has been identified at time of analysis and EPSS exploitation probability remains very low at 0.03%.

Technical ContextAI

Dawn is Chromium's open-source implementation of the WebGPU standard, providing a cross-platform abstraction over native graphics APIs such as Vulkan, Metal, D3D12, and OpenGL. The flaw is classified as CWE-457 (Use of Uninitialized Variable), meaning a code path in Dawn reads from a memory region or variable before it has been deterministically initialized, returning whatever stale data happened to occupy that allocation. Because Dawn executes inside Chrome's GPU/renderer processes when handling WebGPU calls invoked from JavaScript on a web page, an attacker-controlled HTML/JS payload can shape these calls to surface uninitialized bytes back into JavaScript-observable buffers. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, scoped to versions earlier than 149.0.7827.53.

RemediationAI

Vendor-released patch: upgrade Google Chrome desktop to 149.0.7827.53 or later via the Chrome Releases stable channel update at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html, and force a browser restart so the new binary is loaded - auto-update is the fastest path for unmanaged endpoints, while managed fleets should push the build through Chrome Browser Cloud Management, Group Policy, Jamf, or Intune and verify the version reported by chrome://version. For Chromium-based browsers, apply the equivalent vendor update once the upstream merge lands (track the Chromium issue at https://issues.chromium.org/issues/513249847). As a temporary compensating control until patching completes, disable WebGPU by setting the chrome://flags/#enable-unsafe-webgpu and #enable-webgpu-developer-features flags to Disabled, or push the WebGPU-related enterprise policies (e.g., disabling hardware acceleration via HardwareAccelerationModeEnabled=false) - this neutralizes the attack surface in Dawn but will break legitimate WebGPU sites and degrade graphics performance for canvas/3D workloads. Network-layer mitigations such as blocking untrusted browsing categories at the proxy reduce drive-by exposure but do not address targeted phishing lures.