What is the CVSS score of CVE-2026-10983?

CVE-2026-10983 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-10983?

Google Chrome versions prior to 149.0.7827.53 contain a critical sandbox escape vulnerability in the Dawn component enabling remote code execution when users visit malicious websites; no public…. A patch is available.

How to fix or mitigate CVE-2026-10983?

Within 24 hours: Inventory Chrome installations and identify critical user populations (executives, developers, system administrators). Within 7 days: Deploy Chrome version 149.0.7827.53 or later to non-critical systems first and communicate mandatory patching timeline. Within 30 days: Complete deployment across all Chrome installations, verify 100% patch compliance via endpoint management, and audit network logs for exploitation attempts.

Google Chrome CVE-2026-10983

EUVD-2026-34432 CRITICAL

Improper Input Validation (CWE-20)

2026-06-04 chrome-cve-admin@google.com

GHSA-fx7p-p9mq-g46q

Information Disclosure Google Red Hat Suse Chrome

9.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 20:30 vuln.today

CVSS changed

Jun 05, 2026 - 18:22 NVD

9.6 (CRITICAL)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

CRITICAL 9.6

DescriptionCVE.org

Insufficient validation of untrusted input in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome's Dawn component (versions prior to 149.0.7827.53) allows remote attackers to break out of the renderer sandbox via a crafted HTML page when a user visits a malicious site. Google Chromium rates the severity as High and a fix has shipped in the stable channel; no public exploit identified at time of analysis and EPSS exploitation probability is currently very low (0.05%).

Technical ContextAI

Dawn is Chromium's cross-platform implementation of the WebGPU standard, translating WebGPU API calls into native graphics backends (Vulkan, Metal, D3D12, OpenGL). Because Dawn handles GPU command buffers and shader inputs originating from untrusted web content, it sits at a sensitive trust boundary between the renderer and the GPU process. The root cause is classified as CWE-20 (Improper Input Validation), meaning Dawn failed to sufficiently validate attacker-controlled data from a web page before processing it, enabling a path out of the renderer sandbox. The CVSS scope-changed (S:C) metric indicates the impact extends beyond the initially compromised component, consistent with breaking the sandbox isolation boundary.

RemediationAI

Vendor-released patch: update Google Chrome to 149.0.7827.53 or later on all desktop platforms, per the Chrome Releases stable channel update at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html (tracking issue https://issues.chromium.org/issues/513947609). Most installations will receive this automatically; confirm by checking chrome://settings/help and forcing a relaunch, and in managed environments push the update through your enterprise update channel (Chrome Browser Cloud Management, Intune, JAMF, etc.). For Chromium-based browsers, apply the corresponding vendor build that incorporates the Dawn fix. As a temporary compensating control until the update is deployed, administrators can disable WebGPU via the WebGPU enterprise policy or the chrome://flags/#enable-unsafe-webgpu setting; the trade-off is broken functionality on WebGPU-powered sites (GPU-accelerated graphics, ML demos, some games). User awareness around avoiding untrusted sites offers limited mitigation since UI:R here is satisfied by a normal page visit.