What is the CVSS score of CVE-2026-10997?

CVE-2026-10997 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-10997?

Yes, a patch is available for CVE-2026-10997. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-10997

EUVD-2026-34446 MEDIUM

Incorrect Permission Assignment for Critical Resource (CWE-732)

2026-06-04 chrome-cve-admin@google.com

GHSA-r2gf-386x-6q74

Authentication Bypass Google

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Red Hat

7.2 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 06, 2026 - 02:08 vuln.today

CVSS changed

Jun 06, 2026 - 02:07 NVD

6.5 (MEDIUM)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

MEDIUM 6.5

DescriptionNVD

Insufficient policy enforcement in Extensions in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension to bypass discretionary access control via a crafted Chrome Extension. (Chromium security severity: Medium)

AnalysisAI

Insufficient policy enforcement in Google Chrome's Extensions subsystem prior to version 149.0.7827.53 allows a crafted extension to bypass discretionary access controls (DAC), producing high-integrity impact with no confidentiality or availability consequence. Exploitation requires an attacker to socially engineer a user into installing a malicious extension, after which the extension subverts Chrome's permission boundary enforcement. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog; EPSS is extremely low at 0.01% (1st percentile), consistent with no observed mass exploitation.

Technical ContextAI

Google Chrome's extension system enforces a policy framework governing what resources and capabilities installed extensions may access. The root cause is CWE-732 (Incorrect Permission Assignment for Critical Resource), meaning the enforcement layer fails to correctly restrict what a crafted extension can do within Chrome's permission model, allowing it to circumvent the Discretionary Access Control boundaries that are supposed to sandbox extension capabilities. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all Chrome builds across all platforms prior to stable channel version 149.0.7827.53. The Chromium issue tracker reference (issues.chromium.org/issues/464217867) may contain additional technical detail, though issue visibility is typically restricted until after patch release.

RemediationAI

Update Google Chrome to stable channel version 149.0.7827.53 or later, which contains the vendor-released patch addressing this insufficient policy enforcement in the Extensions subsystem. The release advisory is at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. For organizations that cannot immediately deploy the update, the most targeted compensating control is enforcing an extension installation policy via Google Admin Console (ExtensionInstallBlocklist set to block all with an explicit allowlist via ExtensionInstallAllowlist), which directly eliminates the attack surface since exploitation requires installation of a malicious extension. This trade-off is that users will be unable to self-install extensions, which may require IT-managed approval workflows. Blocking sideloading of extensions via policy (BlockExternalExtensions) is an additional hardening measure. Generic network-level controls are not effective here since the attack vector is user-initiated extension installation, not an inbound network request.