What is the CVSS score of CVE-2026-10980?

CVE-2026-10980 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-10980?

Yes, a patch is available for CVE-2026-10980. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-10980

EUVD-2026-34429 MEDIUM

Improper Input Validation (CWE-20)

2026-06-04 chrome-cve-admin@google.com

GHSA-j7v7-xwp3-68qr

Authentication Bypass Google Red Hat Suse Chrome

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

SUSE

MEDIUM

qualitative

Red Hat

8.7 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 20:41 vuln.today

CVSS changed

Jun 05, 2026 - 20:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

MEDIUM 6.5

DescriptionCVE.org

Insufficient validation of untrusted input in DevTools in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Same-origin policy bypass in Google Chrome's DevTools component (all versions prior to 149.0.7827.53) allows a remote attacker who has already compromised the renderer process to bypass SOP protections via a crafted HTML page, resulting in a high-integrity impact with no confidentiality or availability loss. The attack requires user interaction (victim must visit a malicious page) and a prior renderer process compromise as a chained prerequisite, materially constraining real-world exploitability beyond the raw CVSS score implies. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog; EPSS probability stands at 0.02% (6th percentile), consistent with a low-probability exploitation scenario.

Technical ContextAI

The vulnerability resides in the DevTools subsystem of Google Chrome (CPE: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) and is rooted in CWE-20 (Improper Input Validation). DevTools processes untrusted input passed from a potentially compromised renderer context without sufficient validation, enabling crafted HTML content to manipulate DevTools in a way that subverts the browser's same-origin policy (SOP) enforcement. SOP is a critical browser security boundary that prevents scripts from one origin from accessing resources on a different origin; bypassing it allows cross-origin content manipulation. The attack path is a browser sandbox escape chain: a separate vulnerability must first establish renderer process compromise before this flaw can be leveraged. Reported by chrome-cve-admin@google.com and tracked as EUVD-2026-34429.

RemediationAI

The primary remediation is to upgrade Google Chrome to version 149.0.7827.53 or later, which is confirmed as the vendor-patched release per the Google Chrome Stable Channel Update advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Chrome's auto-update mechanism should deliver this patch automatically; administrators managing enterprise deployments should verify rollout via policy controls. As a compensating control where immediate patching is not possible, restricting or disabling DevTools access for end users (via enterprise policy DevToolsAvailability=Disabled) would eliminate the vulnerable attack surface, though this trade-off removes legitimate developer tooling. Additionally, because exploitation requires a prior renderer compromise, ensuring Chrome's site isolation and sandbox features are enabled (default in modern Chrome) raises the bar for the full attack chain.