What is the CVSS score of CVE-2026-10991?

CVE-2026-10991 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-10991?

A remote code execution vulnerability in Google Chrome versions prior to 149.0.7827.53 allows attackers to compromise employee endpoints through malicious websites; the flaw impacts all Chrome users…. A patch is available.

How to fix or mitigate CVE-2026-10991?

Within 24 hours: Alert all users and IT teams; confirm organizational deployment infrastructure can deliver Chrome 149.0.7827.53 or later. Within 7 days: Deploy Google Chrome 149.0.7827.53 or later to all organizational endpoints via standard update mechanisms or MDM enrollment. Within 30 days: Audit all endpoints to verify 100% compliance with minimum version requirement.

Google Chrome CVE-2026-10991

EUVD-2026-34440 HIGH

Use After Free (CWE-416)

2026-06-04 chrome-cve-admin@google.com

GHSA-vc9q-5cjg-hv9j

RCE Denial Of Service Google Use After Free Memory Corruption

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 02:59 vuln.today

CVSS changed

Jun 05, 2026 - 02:22 NVD

8.8 (HIGH)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

HIGH 8.8

DescriptionCVE.org

Use after free in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Remote code execution in Google Chrome's V8 JavaScript engine prior to version 149.0.7827.53 allows remote attackers to execute arbitrary code inside the renderer sandbox by serving a crafted HTML page and convincing a user to perform specific UI gestures. The flaw is a use-after-free (CWE-416) memory corruption issue with a high CVSS score of 8.8, rated Medium severity by Chromium; no public exploit identified at time of analysis.

Technical ContextAI

V8 is Google's high-performance open-source JavaScript and WebAssembly engine that powers Chrome, Chromium-based browsers (Edge, Opera, Brave), and Node.js. Use-after-free vulnerabilities (CWE-416) occur when a program continues to reference memory after it has been freed, allowing an attacker to manipulate the freed memory region and potentially hijack control flow. V8 use-after-free bugs are a recurring class of vulnerability historically leveraged for renderer-process RCE, and while exploitation occurs inside Chrome's sandbox, they are frequently chained with sandbox escapes to achieve full system compromise.

RemediationAI

Vendor-released patch: update Google Chrome to version 149.0.7827.53 or later via the Stable channel as documented at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html, and consult the Chromium issue tracker entry at https://issues.chromium.org/issues/503553614 for technical context. Enterprise administrators should push the update through Google Update, Chrome Browser Cloud Management, or their endpoint management platform, and users of Chromium-derived browsers (Edge, Opera, Brave) should install vendor updates once those projects rebase onto the patched V8. As a compensating control before patching, restrict JavaScript execution on untrusted origins via enterprise policy (DefaultJavaScriptSetting / JavaScriptAllowedForUrls) or enable Site Isolation and the strictest Safe Browsing tier, accepting the trade-off that broad JavaScript restrictions break most modern web applications.