What is the CVSS score of CVE-2026-10978?

CVE-2026-10978 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-10978?

Google Chrome on Windows (versions prior to 149.0.7827.53) contains a remote code execution vulnerability enabling attackers to compromise systems through normal web browsing activity.. A patch is available.

How to fix or mitigate CVE-2026-10978?

Within 24 hours: Deploy Google Chrome version 149.0.7827.53 or later to all Windows systems; initiate automated update distribution if available. Within 7 days: Verify patch deployment completion across all managed endpoints. Within 30 days: Review security logs and endpoint monitoring for signs of exploitation attempts and confirm full compliance with the patch requirement.

Google Chrome CVE-2026-10978

EUVD-2026-34427 HIGH

Use After Free (CWE-416)

2026-06-04 chrome-cve-admin@google.com

GHSA-v6g5-6xwg-4mm9

RCE Denial Of Service Google Use After Free Memory Corruption Microsoft

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 02:58 vuln.today

CVSS changed

Jun 05, 2026 - 02:22 NVD

8.8 (HIGH)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in Chromoting in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code via malicious network traffic. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome on Windows prior to version 149.0.7827.53 stems from a use-after-free flaw in the Chromoting (Chrome Remote Desktop) component. A remote attacker can deliver malicious network traffic that, combined with minimal user interaction, allows arbitrary code execution within the browser's renderer context. No public exploit identified at time of analysis, but Google rates the underlying Chromium severity as High.

Technical ContextAI

Chromoting is the internal codename for Chrome Remote Desktop, the protocol stack that enables remote desktop sessions through Chrome. The flaw is classified as CWE-416 (Use After Free), a memory-corruption class where a pointer continues to be dereferenced after the underlying heap object has been freed, allowing an attacker who controls the reallocated memory to redirect execution flow. Use-after-free issues in Chromium have a long history of being weaponized into reliable RCE primitives once paired with a heap-grooming primitive, and the Chromoting subsystem in particular processes attacker-influenced network frames, providing a direct path for malicious input to reach the vulnerable code.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 for Windows - upgrade immediately via Chrome's auto-update mechanism or by forcing a relaunch through chrome://settings/help, and validate enterprise managed deployments using Google Update / Chrome Browser Cloud Management as described in the Chrome Releases advisory (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html). Where patching cannot be completed immediately, a targeted compensating control is to disable Chrome Remote Desktop / Chromoting via the RemoteAccessHostFirewallTraversal and RemoteAccessHostClientDomainList enterprise policies, or by uninstalling the Chrome Remote Desktop host; the trade-off is loss of remote-desktop functionality for users who legitimately rely on it. Network-layer restrictions on outbound connectivity to the Chromoting relay endpoints (*.talkgadget.google.com, remoting endpoints) can reduce, but not eliminate, exposure since untrusted page content may still influence the same code paths.