What is the CVSS score of CVE-2026-10995?

CVE-2026-10995 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-10995?

Google Chrome versions before 149.0.7827.53 contain a heap corruption vulnerability in the TabStrip component that allows unauthenticated remote attackers to compromise confidentiality, integrity,…. A patch is available.

How to fix or mitigate CVE-2026-10995?

Within 24 hours: Audit Chrome deployment scope across managed endpoints and BYOD devices. Within 7 days: Deploy Chrome 149.0.7827.53 or later to all managed devices via group policy or MDM; send mandatory update notification to BYOD users. Within 30 days: Verify 100% compliance via asset inventory; flag and isolate any Chrome instances below version 149.0.7827.53.

Google Chrome CVE-2026-10995

EUVD-2026-34444 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-06-04 chrome-cve-admin@google.com

GHSA-7v79-8rjm-gq7f

Buffer Overflow Google Heap Overflow

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Red Hat

8.3 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 06, 2026 - 04:20 vuln.today

CVSS changed

Jun 06, 2026 - 02:07 NVD

8.8 (HIGH)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

HIGH 8.8

DescriptionNVD

Heap buffer overflow in TabStrip in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Heap corruption in Google Chrome's TabStrip component before 149.0.7827.53 lets a remote attacker who can lure a user into specific UI interactions on a malicious HTML page trigger memory corruption with high impact to confidentiality, integrity, and availability. The flaw carries a CVSS 8.8 due to network reachability and lack of authentication, though user interaction is required; there is no public exploit identified at time of analysis and EPSS is very low at 0.03%.

Technical ContextAI

The vulnerability lives in Chrome's TabStrip, the browser UI component that manages tab rendering, drag-and-drop, and tab switching in the Chromium front-end. The root cause is CWE-122 (Heap-based Buffer Overflow), where a write or read passes the allocated bounds of a heap chunk owned by TabStrip state, typically because a length, index, or container size assumption is violated during a UI event. Affected scope per CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, narrowed by the EUVD range to all Chrome versions prior to 149.0.7827.53 across desktop channels. Chromium-grade heap corruption in the renderer/UI layer is the same bug class historically chained with sandbox escapes to achieve full code execution, though Chromium rated this specific issue as Medium severity internally.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 (or later) on the Stable desktop channel - verify via chrome://settings/help and force-restart browsers to apply the auto-update, prioritizing fleet-wide rollout through MDM or Group Policy (see https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html). For Chromium-based browsers, update to the vendor build that incorporates the equivalent Chromium milestone. No vendor-documented workaround exists for the underlying TabStrip code path; compensating controls until patching completes include enforcing site isolation (already default), restricting access to untrusted web content via web filtering or browser isolation gateways (trade-off: latency and broken interactive sites), and disabling tab drag/restore extensions that could amplify TabStrip event surfaces (trade-off: minor UX loss). Disabling JavaScript globally would reduce HTML attack staging but breaks most modern sites and is not recommended as a sustained control.