What is the CVSS score of CVE-2026-10995?

CVE-2026-10995 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-10995?

Google Chrome versions before 149.0.7827.53 contain a heap corruption vulnerability in the TabStrip component that allows unauthenticated remote attackers to compromise confidentiality, integrity,…. A patch is available.

How to fix or mitigate CVE-2026-10995?

Within 24 hours: Audit Chrome deployment scope across managed endpoints and BYOD devices. Within 7 days: Deploy Chrome 149.0.7827.53 or later to all managed devices via group policy or MDM; send mandatory update notification to BYOD users. Within 30 days: Verify 100% compliance via asset inventory; flag and isolate any Chrome instances below version 149.0.7827.53.

Google Chrome CVE-2026-10995

EUVD-2026-34444 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-06-04 chrome-cve-admin@google.com

GHSA-7v79-8rjm-gq7f

Heap Overflow Google Buffer Overflow Chrome

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Red Hat

8.3 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 06, 2026 - 04:20 vuln.today

CVSS changed

Jun 06, 2026 - 02:07 NVD

8.8 (HIGH)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

HIGH 8.8

DescriptionCVE.org

Heap buffer overflow in TabStrip in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Heap corruption in Google Chrome's TabStrip component before 149.0.7827.53 lets a remote attacker who can lure a user into specific UI interactions on a malicious HTML page trigger memory corruption with high impact to confidentiality, integrity, and availability. The flaw carries a CVSS 8.8 due to network reachability and lack of authentication, though user interaction is required; there is no public exploit identified at time of analysis and EPSS is very low at 0.03%.

Technical ContextAI

The vulnerability lives in Chrome's TabStrip, the browser UI component that manages tab rendering, drag-and-drop, and tab switching in the Chromium front-end. The root cause is CWE-122 (Heap-based Buffer Overflow), where a write or read passes the allocated bounds of a heap chunk owned by TabStrip state, typically because a length, index, or container size assumption is violated during a UI event. Affected scope per CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, narrowed by the EUVD range to all Chrome versions prior to 149.0.7827.53 across desktop channels. Chromium-grade heap corruption in the renderer/UI layer is the same bug class historically chained with sandbox escapes to achieve full code execution, though Chromium rated this specific issue as Medium severity internally.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 (or later) on the Stable desktop channel - verify via chrome://settings/help and force-restart browsers to apply the auto-update, prioritizing fleet-wide rollout through MDM or Group Policy (see https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html). For Chromium-based browsers, update to the vendor build that incorporates the equivalent Chromium milestone. No vendor-documented workaround exists for the underlying TabStrip code path; compensating controls until patching completes include enforcing site isolation (already default), restricting access to untrusted web content via web filtering or browser isolation gateways (trade-off: latency and broken interactive sites), and disabling tab drag/restore extensions that could amplify TabStrip event surfaces (trade-off: minor UX loss). Disabling JavaScript globally would reduce HTML attack staging but breaks most modern sites and is not recommended as a sustained control.