What is the CVSS score of CVE-2026-10981?

CVE-2026-10981 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-10981?

Yes, a patch is available for CVE-2026-10981. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-10981

EUVD-2026-34430 MEDIUM

Improper Input Validation (CWE-20)

2026-06-04 chrome-cve-admin@google.com

GHSA-83qc-m7mq-vc9c

Information Disclosure Google

6.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

SUSE

MEDIUM

qualitative

Red Hat

6.8 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 20:41 vuln.today

CVSS changed

Jun 05, 2026 - 20:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

MEDIUM 6.5

DescriptionCVE.org

Insufficient validation of untrusted input in Codecs in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted video file. (Chromium security severity: High)

AnalysisAI

Cross-origin data leakage in Google Chrome's Codecs subsystem affects all versions prior to 149.0.7827.53, enabling an attacker who has already compromised the renderer process to exfiltrate sensitive data from other origins via a crafted video file. The vulnerability bypasses Same-Origin Policy protections and exposes high-confidentiality content (CVSS C:H), though impact is scoped to information disclosure with no integrity or availability consequence. This CVE is not currently listed in CISA KEV, no public exploit has been identified at time of analysis, and EPSS at 0.05% (15th percentile) indicates low widespread exploitation probability.

Technical ContextAI

The flaw resides in Chrome's Codecs subsystem - the media decoding layer responsible for processing video and audio streams. CWE-20 (Improper Input Validation) identifies the root cause: the codec fails to sufficiently validate attacker-controlled input embedded in a crafted video file, allowing it to read memory or data outside its intended scope. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all Chrome releases across platforms prior to 149.0.7827.53. The attack is specifically contextualized as a post-renderer-compromise primitive - meaning this vulnerability functions as a second stage in an exploit chain, not a standalone entry point. Cross-origin data leakage in this context refers to content from other browser tabs, authenticated sessions, or iframes being made accessible to the attacker despite Same-Origin Policy enforcement.

RemediationAI

Update Google Chrome to version 149.0.7827.53 or later - this is the vendor-released patch addressing the insufficient codec input validation. Update instructions and release notes are published at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. For enterprise environments where immediate patching is not feasible, consider restricting media playback from untrusted sources using Chrome enterprise policies (e.g., blocking autoplay or restricting file:// and cross-origin media loading via URL allowlisting), though this will impact legitimate video functionality. Since exploitation requires a pre-compromised renderer, any existing controls that reduce renderer exploit surface (e.g., Site Isolation enabled, renderer sandboxing at OS level) also reduce exposure to this specific vulnerability as a chained second stage. Chromium-based browsers should be updated independently as vendor patches become available.