What is the CVSS score of EUVD-2026-33152?

EUVD-2026-33152 has a contested CVSS base score of 5.0 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Is there a patch available for EUVD-2026-33152?

Yes, a patch is available for EUVD-2026-33152. Update the affected software to the latest version immediately.

Google Chrome EUVD-2026-33152

| CVE-2026-10010 MEDIUM

Origin Validation Error (CWE-346)

2026-05-28 Chrome

GHSA-9jr4-r64p-fhqf

Google Authentication Bypass Chrome

Medium

Disputed · 5.0 NVD

Severity by source

Sources disagree (Low–High)

NVD PRIMARY

5.0 MEDIUM

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L

SUSE

3.1 LOW

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L

Red Hat

5.8 HIGH

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 21:30 vuln.today

CVSS changed

May 29, 2026 - 19:22 NVD

5.0 (MEDIUM)

CVE Published

May 28, 2026 - 22:25 nvd

MEDIUM 5.0

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in Input in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Site isolation bypass in Google Chrome for Android (prior to 148.0.7778.216) enables a remote attacker who has already achieved renderer process compromise to cross Chrome's site isolation boundary via a specially crafted HTML page. The flaw resides in the Input handling component (CWE-346: Origin Validation Error), where improper implementation fails to enforce origin boundaries adequately within the renderer context on Android. No public exploit code exists and no active exploitation has been identified at time of analysis; EPSS is 0.02% (4th percentile) and SSVC rates exploitation as none - consistent with the high-complexity, chained-attack prerequisites.

Technical ContextAI

Google Chrome's site isolation is a defense-in-depth mechanism that confines each renderer process to a single site's origin, preventing cross-origin data access even if one renderer is compromised. CWE-346 (Origin Validation Error) indicates that the Input subsystem - responsible for routing user or programmatic input events within the browser - improperly validates the origin context when handling input in a compromised renderer on Android. The Android-specific surface is notable: Chrome on Android uses a different process model and IPC path from desktop, which may expose origin checks that desktop builds enforce differently. The affected CPE (cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) covers all Chrome versions prior to 148.0.7778.216 on Android without additional qualifier, suggesting the flaw is architectural to the Android Input implementation rather than version-specific regression.

RemediationAI

Update Google Chrome for Android to version 148.0.7778.216 or later, which contains the vendor-released patch as confirmed by the Chrome Stable Channel advisory (http://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html). Updates are available via the Google Play Store or Chrome's built-in update mechanism. Because exploitation requires a prior renderer compromise, organizations unable to immediately patch should prioritize ensuring Chrome is not running in modes that reduce renderer sandboxing (e.g., avoid disabling the Android sandbox via developer flags). Additionally, restricting access to untrusted or attacker-controlled web content through network-level controls or enterprise browser policies reduces the delivery surface for the initial renderer exploit that this vulnerability depends on as a second stage.