What is the CVSS score of CVE-2026-10994?

CVE-2026-10994 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-10994?

Yes, a patch is available for CVE-2026-10994. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-10994

EUVD-2026-34443 MEDIUM

Use of Uninitialized Variable (CWE-457)

2026-06-04 chrome-cve-admin@google.com

GHSA-mqrm-gc2f-mchp

Information Disclosure Google Red Hat Suse Chrome

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Red Hat

6.5 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 06, 2026 - 01:54 vuln.today

CVSS changed

Jun 06, 2026 - 01:52 NVD

6.5 (MEDIUM)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

MEDIUM 6.5

DescriptionCVE.org

Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Uninitialized memory read in Chrome's ANGLE graphics layer exposes process memory contents to remote attackers who can trick users into visiting a crafted HTML page. Affected are all Chrome releases prior to 149.0.7827.53 on desktop platforms, as confirmed by the Google Chrome Releases advisory. No public exploit identified at time of analysis, and the EPSS score of 0.03% (11th percentile) indicates low current exploitation probability; however, the CVSS confidentiality impact is rated High, meaning successful exploitation could yield sensitive in-process data such as credentials, tokens, or cryptographic material resident in memory.

Technical ContextAI

ANGLE (Almost Native Graphics Layer Engine) is Chrome's cross-platform OpenGL ES implementation that translates WebGL and graphics API calls to platform-native backends such as DirectX on Windows or Metal on macOS. CWE-457 (Use of Uninitialized Variable) describes a condition where a variable or memory buffer is consumed before it has been explicitly initialized, causing the code to read whatever bytes were previously resident at that memory location - commonly heap or stack remnants from prior allocations. In Chrome's renderer process, ANGLE handles GPU-accelerated content rendered from HTML/JavaScript, meaning a crafted page can deliberately trigger graphics operations that cause ANGLE to dereference or return uninitialized buffer contents. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all Chrome desktop variants prior to the fixed release.

RemediationAI

The primary fix is to update Google Chrome to version 149.0.7827.53 or later, as released in the June 2026 Stable Channel Update documented at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Chrome's auto-update mechanism will deliver this patch automatically on supported platforms; administrators managing enterprise fleets should verify deployment via Chrome Browser Cloud Management or group policy. If immediate patching is not feasible, restricting access to untrusted or external websites via web content filtering reduces exposure, though this carries significant operational impact. Disabling WebGL (via the --disable-webgl flag or enterprise policy) may reduce the ANGLE attack surface, but will break GPU-accelerated web content and is not a substitute for patching. There are no vendor-published workarounds short of upgrading.