What is the CVSS score of CVE-2026-10989?

CVE-2026-10989 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-10989?

A heap corruption vulnerability in Google Chrome's JavaScript engine (CVE-2026-10989, CVSS 8.8) could allow remote code execution on employee and customer devices when users visit a malicious…. A patch is available.

How to fix or mitigate CVE-2026-10989?

Within 24 hours: Assess Chrome deployment scope across the organization and notify stakeholders of the vulnerability. Within 7 days: Begin pushing Chrome 149.0.7827.53 via MDM/patch management to all managed endpoints; prioritize systems accessing sensitive data or customer-facing services. Within 30 days: Achieve 95%+ deployment rate; document any unpatched systems and implement monitoring.

Google Chrome CVE-2026-10989

EUVD-2026-34438 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-06-04 chrome-cve-admin@google.com

GHSA-mpfj-4qfv-j4r3

Buffer Overflow Google Heap Overflow

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 16:22 vuln.today

CVSS changed

Jun 05, 2026 - 16:22 NVD

8.8 (HIGH)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

HIGH 8.8

DescriptionNVD

Inappropriate implementation in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Heap corruption in Google Chrome's V8 JavaScript engine prior to version 149.0.7827.53 allows remote attackers to potentially achieve code execution when a user visits a crafted HTML page and performs specific UI interactions. The flaw is rated High severity by Chromium and CVSS 8.8, though no public exploit identified at time of analysis and EPSS scoring places near-term mass exploitation probability at 0.03%. A vendor patch is already available through the Stable Channel update.

Technical ContextAI

The vulnerability resides in V8, Chrome's open-source JavaScript and WebAssembly engine, which compiles JS into optimized machine code via its TurboFan/Maglev/Sparkplug pipelines and manages JavaScript objects on a garbage-collected heap. The root cause is classified as CWE-122 (Heap-based Buffer Overflow), indicating that an inappropriate implementation in V8 allows out-of-bounds writes within heap-allocated memory regions, typically by mismanaging object sizes, type confusion adjacent to heap reads/writes, or incorrect bounds enforcement during JIT-compiled code execution. Successful corruption of V8 heap metadata or adjacent objects can lead to arbitrary read/write primitives suitable for renderer-process code execution, though sandbox escape would still require an additional bug.

RemediationAI

Upgrade Chrome to the vendor-released patch version 149.0.7827.53 or later via the Stable Channel update described at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html; on managed fleets, force a browser relaunch to apply the update since Chrome only loads the new binary on restart. Where immediate patching is blocked, compensating controls include disabling the V8 JIT optimizer via the --js-flags="--jitless" launch flag or the SiteIsolation/JITless enterprise policy (trade-off: noticeable JavaScript performance degradation on modern web apps), restricting browsing to a curated allowlist of trusted sites via enterprise policy URLBlocklist/URLAllowlist to reduce exposure to attacker-controlled HTML, and ensuring Chromium-based derivatives (Edge, Brave, Opera, Electron apps) are tracked for their respective backported releases referencing the same upstream fix at https://issues.chromium.org/issues/516311623.