What is the CVSS score of CVE-2026-10982?

CVE-2026-10982 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-10982?

Google Chrome contains a critical vulnerability (CVE-2026-10982) that allows attackers to execute arbitrary code and potentially steal sensitive data when employees visit malicious websites, with no…. A patch is available.

How to fix or mitigate CVE-2026-10982?

Within 24 hours: Identify all systems running Chrome and audit version deployments; notify IT and end-users of patch requirements. Within 7 days: Deploy Google Chrome 149.0.7827.53 or later to all affected systems, prioritizing high-risk roles (finance, legal, executive). Within 30 days: Verify 100% patch deployment via asset management tools, confirm no pre-149.0.7827.53 versions remain, and review security logs for exploitation indicators.

Google Chrome CVE-2026-10982

EUVD-2026-34431 HIGH

Use After Free (CWE-416)

2026-06-04 chrome-cve-admin@google.com

GHSA-44jx-cc5r-6xx6

Google Memory Corruption RCE Use After Free Denial Of Service Red Hat Suse Chrome

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 02:58 vuln.today

CVSS changed

Jun 05, 2026 - 02:22 NVD

8.8 (HIGH)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in WebXR in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome versions prior to 149.0.7827.53 allows a remote attacker to execute arbitrary code within the renderer sandbox by enticing a user to visit a crafted HTML page that triggers a use-after-free in the WebXR component. Google rates the issue High severity and CVSS scores it 8.8, with user interaction required but no authentication or privileges needed; no public exploit identified at time of analysis.

Technical ContextAI

WebXR is the browser API that exposes virtual and augmented reality device access to web content, implemented in Chromium's renderer process. The flaw is a CWE-416 Use-After-Free, meaning the WebXR code references memory that has already been freed - typically when an object's lifetime is mismanaged across asynchronous XR session events - allowing a controlled allocation to land in the freed slot and hijack a function pointer or vtable. Because Chrome's renderer enforces a sandbox, successful exploitation grants code execution constrained to that sandbox, though use-after-free bugs in the renderer are historically chainable with sandbox escapes to achieve full system compromise.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 or later on the Stable desktop channel - update via Chrome's built-in updater (chrome://settings/help) or push through enterprise management (Group Policy, Chrome Browser Cloud Management, Jamf, Intune) per the advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Users of Chromium-based browsers should track their vendor's release notes and update once the upstream fix is merged. If patching must be delayed, a targeted compensating control is to disable WebXR by setting the WebXrImmersiveArEnabled enterprise policy to Disabled (and/or blocking the chrome://flags WebXR entries via policy), which removes the vulnerable attack surface at the cost of breaking legitimate VR/AR web experiences; site-isolation and strict-origin isolation should remain enabled to limit renderer compromise blast radius.