What is the CVSS score of CVE-2026-10988?

CVE-2026-10988 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-10988?

A sandbox escape vulnerability (CVE-2026-10988, CVSS 8.8) in Google Chrome prior to version 149.0.7827.53 allows an attacker who has already compromised the renderer process to break out of the…. A patch is available.

How to fix or mitigate CVE-2026-10988?

24 hours: Issue mandatory patch communication and test Chrome 149.0.7827.53 or later in a pilot environment. 7 days: Deploy Chrome 149.0.7827.53 or later organization-wide via endpoint management; enforce version policy to block pre-149.0.7827.53 releases. 30 days: Verify 100% compliance to patched version; conduct threat hunting for renderer process compromise indicators in endpoint telemetry.

Google Chrome CVE-2026-10988

EUVD-2026-34437 HIGH

Use After Free (CWE-416)

2026-06-04 chrome-cve-admin@google.com

GHSA-2jcx-282p-gv4x

Denial Of Service Use After Free Memory Corruption Google Red Hat Suse Chrome

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.2 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 16:22 vuln.today

CVSS changed

Jun 05, 2026 - 16:22 NVD

8.8 (HIGH)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in Views in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome prior to 149.0.7827.53 allows a remote attacker who has already compromised the renderer process to break out of the browser sandbox via a use-after-free in the Views component, triggered by a crafted HTML page. Google rates the Chromium security severity as High and a vendor patch is available, though no public exploit has been identified at time of analysis and EPSS exploitation probability is currently very low (0.03%).

Technical ContextAI

The flaw resides in Chrome's Views UI framework, the cross-platform widget toolkit used to render browser chrome elements such as menus, toolbars, dialogs, and tabs. The root cause is CWE-416 (Use After Free), a memory-corruption class where an object is freed but a dangling pointer is later dereferenced, enabling attackers with controlled heap layout to achieve arbitrary read/write and ultimately code execution in the affected process. Because Views runs in the privileged browser process (outside the renderer sandbox), a UAF here is a classic sandbox-escape primitive: it bridges from an already-compromised renderer into the higher-privileged process that mediates filesystem, IPC, and OS resource access.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 - update Chrome via the built-in updater (Help > About Google Chrome) or redeploy via enterprise management (Chrome Browser Cloud Management, Group Policy, or MDM) and restart the browser to apply. Reference the Chrome Stable Channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html and the upstream tracker at https://issues.chromium.org/issues/515465685. Users of Chromium-based browsers should apply the equivalent vendor update once available. As an interim compensating control where patching is delayed, restrict browsing to trusted sites via enterprise URL allowlists and enable Site Isolation (on by default in modern Chrome) to limit cross-origin renderer compromise - note that site allowlists materially reduce usability and Site Isolation alone does not block this bug, only narrows the attack surface that feeds the prerequisite renderer compromise.