What is the CVSS score of CVE-2026-10979?

CVE-2026-10979 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-10979?

Yes, a patch is available for CVE-2026-10979. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-10979

EUVD-2026-34428 MEDIUM

Out-of-bounds Read (CWE-125)

2026-06-04 chrome-cve-admin@google.com

GHSA-jhmp-vgf3-g696

Buffer Overflow Information Disclosure Google

6.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

SUSE

MEDIUM

qualitative

Red Hat

6.5 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 20:40 vuln.today

CVSS changed

Jun 05, 2026 - 20:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

MEDIUM 6.5

DescriptionCVE.org

Out of bounds read in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Out-of-bounds read in ANGLE (Chrome's graphics abstraction layer) affects all Google Chrome versions prior to 149.0.7827.53, enabling remote information disclosure from process memory. An unauthenticated remote attacker can trigger the memory leak by inducing a victim to visit a crafted HTML page - no privileges are required on the attacker's side, though user interaction is necessary. No public exploit identified at time of analysis and EPSS sits at 0.03% (11th percentile), indicating low current exploitation probability despite Google's 'High' Chromium severity rating.

Technical ContextAI

ANGLE (Almost Native Graphics Layer Engine) is Chrome's cross-platform graphics translation library, converting OpenGL ES calls to native APIs such as Direct3D (Windows), Metal (macOS), and Vulkan (Linux). The vulnerability is classified as CWE-125 (Out-of-bounds Read), meaning ANGLE reads beyond the bounds of an allocated memory buffer during rendering operations - most likely triggered by malformed WebGL or Canvas rendering instructions embedded in a crafted HTML page. This class of bug arises from missing or inadequate bounds validation on GPU-related data structures. The affected product is identified via CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, confirming all Chrome variants across platforms are within scope prior to the patched release.

RemediationAI

Upgrade to Google Chrome 149.0.7827.53 or later - this is the vendor-released patch confirmed via the stable channel update advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Chrome's built-in auto-update mechanism will deliver this release automatically; users should verify by navigating to chrome://settings/help and confirming the displayed version. No documented workarounds exist for this specific vulnerability. As an interim measure for high-risk environments, disabling WebGL via chrome://flags/#disable-webgl reduces ANGLE's attack surface but will break a significant portion of web content and browser-based applications and is therefore not suitable for general deployment. Given the UI:R exploitation requirement, user awareness around unsolicited links provides a lightweight secondary layer of defense.