What is the CVSS score of CVE-2026-10987?

CVE-2026-10987 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-10987?

Google Chrome versions prior to 149.0.7827.53 contain a critical remote code execution vulnerability in the V8 JavaScript engine that attackers could exploit through malicious web pages to compromise…. A patch is available.

How to fix or mitigate CVE-2026-10987?

Within 24 hours: Inventory Chrome deployments and versions organization-wide to determine exposure scope. Within 7 days: Begin staged deployment of Chrome 149.0.7827.53 or later, prioritizing critical systems and high-risk user groups. Within 30 days: Complete full organization-wide deployment to all Chrome instances and configure Chrome auto-update policies to prevent future version drift.

Google Chrome CVE-2026-10987

EUVD-2026-34436 HIGH

External Control of Assumed-Immutable Web Parameter (CWE-472)

2026-06-04 chrome-cve-admin@google.com

GHSA-74wg-r88r-3rgq

Google RCE Red Hat Suse Chrome

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 02:59 vuln.today

CVSS changed

Jun 05, 2026 - 02:22 NVD

8.8 (HIGH)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

HIGH 8.8

DescriptionCVE.org

Integer overflow in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome versions prior to 149.0.7827.53 allows a remote attacker to execute arbitrary code within the renderer sandbox by serving a crafted HTML page that triggers an integer overflow in the V8 JavaScript engine. The flaw is rated High severity by Chromium and carries a CVSS 8.8 score requiring user interaction (visiting a malicious page). At time of analysis, no public exploit identified at time of analysis and the issue is not listed in CISA KEV, though Chrome V8 bugs are historically attractive targets for exploit developers.

Technical ContextAI

V8 is the open-source JavaScript and WebAssembly engine that powers Google Chrome, Chromium derivatives (Edge, Opera, Brave, Vivaldi), and Node.js. The root cause is CWE-472 (External Control of Assumed-Immutable Web Parameter) as classified, though the description points to a classic integer overflow during JavaScript value processing - a class of bug that commonly yields out-of-bounds reads/writes on V8's heap and is a frequent stepping stone to type confusion or arbitrary read/write primitives. Per the description, successful exploitation here is contained within the renderer sandbox, meaning a separate sandbox-escape bug would be required for full host compromise. The fix landed in Chrome Stable 149.0.7827.53 as referenced in the Chromium issue tracker (issues.chromium.org/issues/515431687) and the Chrome Releases blog.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 (Stable channel) - upgrade all desktop Chrome installations to 149.0.7827.53 or later as announced at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html, and verify with chrome://settings/help. For managed fleets, push the update via Chrome Browser Cloud Management, Google Update, or your endpoint management tool, and force-restart browsers to ensure the renderer picks up the new V8. Downstream Chromium-based browsers (Edge, Brave, Opera, Vivaldi) and Electron/CEF applications should be updated to their next vendor release that incorporates the V8 fix; until then, compensating controls include disabling JavaScript on untrusted origins via enterprise policy (DefaultJavaScriptSetting=2 with per-site allowlists) which breaks most modern web apps, enforcing Site Isolation (already default but verify with --site-per-process), and restricting browsing on high-value endpoints to a curated allowlist. No standalone workaround in the V8 code path is documented in the references, so patching is the only complete fix.