What is the CVSS score of CVE-2026-10996?

CVE-2026-10996 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-10996?

Yes, a patch is available for CVE-2026-10996. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-10996

EUVD-2026-34445 MEDIUM

Origin Validation Error (CWE-346)

2026-06-04 chrome-cve-admin@google.com

GHSA-w6p7-cc7p-w2qr

Authentication Bypass Google Chrome

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Red Hat

9.3 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 06, 2026 - 04:20 vuln.today

CVSS changed

Jun 06, 2026 - 02:07 NVD

6.5 (MEDIUM)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

MEDIUM 6.5

DescriptionCVE.org

Inappropriate implementation in Workers in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Same Origin Policy bypass in Google Chrome's Workers implementation (versions prior to 149.0.7827.53) allows an unauthenticated remote attacker to violate cross-origin integrity boundaries by luring a victim to a crafted HTML page. The CVSS vector confirms no privileges are required but user interaction is necessary, yielding a High integrity impact with no confidentiality or availability consequence. No public exploit has been identified and EPSS stands at 0.02% (4th percentile), indicating no confirmed active exploitation at time of analysis.

Technical ContextAI

The Web Workers API enables browsers to run JavaScript in background threads, separate from the main UI thread, to avoid blocking. Google Chrome's implementation of this API prior to version 149.0.7827.53 contained an 'inappropriate implementation' - a catch-all category indicating a logic or design flaw rather than a classic memory-safety bug. The root cause is an enforcement gap in the Same Origin Policy (SOP) within the Workers subsystem, meaning a Worker spawned by a crafted page could interact with or influence resources from a different origin in ways the SOP is meant to prevent. The affected product is identified via CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* across all platforms. No CWE has been assigned by NVD, so the precise root cause class (e.g., CWE-346 Origin Validation Error or CWE-284 Improper Access Control) cannot be confirmed from the available data.

RemediationAI

Vendor-released patch: Chrome 149.0.7827.53. Update Google Chrome to version 149.0.7827.53 or later via the browser's built-in update mechanism (Settings > Help > About Google Chrome) or via enterprise deployment tools; the official stable channel release announcement is at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Because the attack requires user interaction (visiting a crafted page), organizations that cannot immediately patch can reduce exposure by enforcing web content filtering to block access to untrusted or newly-registered domains, and by enabling enhanced Safe Browsing in Chrome enterprise policy. Note that content filtering alone does not eliminate risk - it only raises the barrier for delivery. There are no known workarounds that directly mitigate the Workers SOP bypass without patching.