What is the CVSS score of CVE-2026-10993?

CVE-2026-10993 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-10993?

Yes, a patch is available for CVE-2026-10993. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-10993

EUVD-2026-34442 MEDIUM

Heap-based Buffer Overflow (CWE-122)

2026-06-04 chrome-cve-admin@google.com

GHSA-q8p9-ghrr-3786

Heap Overflow Google Buffer Overflow Red Hat Suse Chrome

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Red Hat

6.5 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 06, 2026 - 01:54 vuln.today

CVSS changed

Jun 06, 2026 - 01:52 NVD

6.5 (MEDIUM)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

MEDIUM 6.5

DescriptionCVE.org

Heap buffer overflow in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Heap-based buffer overflow in the Skia graphics rendering library within Google Chrome versions prior to 149.0.7827.53 enables remote attackers to read sensitive data from renderer process memory. Exploitation requires no authentication (PR:N) but does require user interaction - a victim must visit a specially crafted HTML page - and yields high confidentiality impact (C:H) with no integrity or availability impact per the CVSS vector. No public exploit has been identified at time of analysis, and the EPSS score of 0.03% (10th percentile) indicates very low current exploitation probability; CISA KEV active exploitation status is not confirmed.

Technical ContextAI

Skia is Google's open-source 2D graphics library that serves as the primary rendering engine within Chrome. The affected component, identified via CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covers all Chrome desktop versions preceding 149.0.7827.53. CWE-122 (Heap-based Buffer Overflow) identifies the root cause: a write operation that exceeds the bounds of a heap-allocated buffer during HTML page rendering in Skia. The CVSS vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N is consistent with an out-of-bounds read primitive - the overflow enables reading adjacent heap memory (information disclosure) rather than redirecting execution, which explains the absence of integrity and availability impact. The renderer process scope (S:U) means exploitation is sandboxed to the renderer and does not inherently imply a sandbox escape.

RemediationAI

Vendor-released patch: Chrome 149.0.7827.53. Update all Chrome desktop installations to version 149.0.7827.53 or later as documented in the Google Chrome stable channel update advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Chrome auto-updates by default on consumer endpoints; enterprise administrators using Google Update policies or third-party endpoint management (e.g., SCCM, Intune) should verify update propagation and confirm version compliance. As a compensating control pending patching, web proxy or DNS-based URL filtering can reduce exposure to attacker-controlled HTML content, though this does not eliminate the vulnerability and imposes operational overhead. Enabling Chrome's Site Isolation feature (enabled by default in most configurations) limits cross-origin memory disclosure radius but does not patch the underlying overflow. Disabling JavaScript would prevent the crafted-page trigger vector but is functionally impractical for most deployments.