What is the CVSS score of CVE-2026-10977?

CVE-2026-10977 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-10977?

Yes, a patch is available for CVE-2026-10977. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-10977

EUVD-2026-34426 MEDIUM

Use of Uninitialized Variable (CWE-457)

2026-06-04 chrome-cve-admin@google.com

GHSA-967v-7f54-jpwg

Information Disclosure Google

6.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

SUSE

MEDIUM

qualitative

Red Hat

6.8 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 20:37 vuln.today

CVSS changed

Jun 05, 2026 - 20:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

MEDIUM 6.5

DescriptionCVE.org

Uninitialized Use in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Uninitialized memory use in Skia, Chrome's 2D graphics rendering engine, enables cross-origin data leakage in Google Chrome versions prior to 149.0.7827.53. Exploitation requires an attacker to have already compromised the renderer process and to deliver a crafted HTML page, making this a second-stage component in a multi-step attack chain rather than a standalone critical exploit. EPSS stands at 0.03% (11th percentile) and no active exploitation has been recorded in CISA KEV, aligning with its role as a chained, post-renderer-compromise primitive.

Technical ContextAI

Skia is Google's open-source 2D graphics library, embedded in Chrome as the core rendering backend responsible for drawing web content. CWE-457 (Use of Uninitialized Variable) describes a root cause where memory is allocated but not zeroed or properly initialized before use; this leftover memory may contain residual data from prior allocations - in this context, potentially sensitive cross-origin content that would ordinarily be protected by the Same-Origin Policy. The affected versions span all Chrome releases prior to 149.0.7827.53 as identified in the EUVD entry EUVD-2026-34426. Because the flaw lives inside the renderer sandbox, exploiting it for data exfiltration requires the renderer process to already be under attacker control, which typically implies a prior sandbox escape or renderer-level code execution vulnerability.

RemediationAI

Vendor-released patch: Chrome 149.0.7827.53. Users and administrators should update to Chrome 149.0.7827.53 or later immediately via Chrome's built-in update mechanism or enterprise deployment tools. The patch is confirmed available per the June 2026 stable channel update advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. For environments where immediate patching is not possible, the risk of this specific vulnerability is partially mitigated by ensuring no other renderer-level vulnerabilities are exploitable on the same Chrome version, since this flaw requires a pre-compromised renderer process - however, this is not a substitute for patching. Organizations using Chrome Enterprise should push the update via policy. Chromium-based browsers (Edge, Brave, etc.) should be verified independently for patch availability against their respective Skia integration versions.