What is the CVSS score of EUVD-2026-33153?

EUVD-2026-33153 has a CVSS 3.1 base score of 3.1 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2026-33153?

Yes, a patch is available for EUVD-2026-33153. Update the affected software to the latest version immediately.

Google Chrome EUVD-2026-33153

| CVE-2026-10011 LOW

Information Exposure (CWE-200)

2026-05-28 Chrome

GHSA-7mc4-mv93-3wr7

Google Information Disclosure Chrome

3.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

3.1 LOW

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 18:23 vuln.today

CVSS changed

May 29, 2026 - 18:22 NVD

3.1 (LOW)

CVE Published

May 28, 2026 - 22:25 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Cross-origin data leak in Google Chrome's Skia graphics engine affects all versions prior to 148.0.7778.216, exploitable only after an attacker has already achieved renderer process compromise via a separate vulnerability. The flaw (CWE-200) allows the compromised renderer to exfiltrate cross-origin data by processing a crafted HTML page, with impact limited to partial confidentiality loss. No public exploit identified at time of analysis; EPSS at 0.03% (11th percentile) and absence of CISA KEV listing confirm low widespread exploitation probability, though the renderer-compromise prerequisite implies real-world use would appear in chained exploit scenarios.

Technical ContextAI

Skia is Google's open-source 2D graphics rendering engine embedded in Chrome, responsible for painting web content, compositing layers, and canvas operations. An inappropriate implementation within Skia - classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) - allows rendering operations to surface data from cross-origin contexts that should be isolated by the browser's same-origin policy. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* confirms all Chrome desktop variants prior to 148.0.7778.216 carry the flaw. Because exploitation requires a pre-existing renderer process compromise, this vulnerability is most relevant as a second-stage component in a multi-stage exploit chain, where a renderer RCE is chained with this info-leak to exfiltrate sensitive cross-origin pixel or canvas data.

RemediationAI

Update Google Chrome to version 148.0.7778.216 or later, which contains the vendor-released patch per the stable channel advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html. Enterprise deployments should force-update via Chrome Browser Cloud Management, Active Directory group policy (ExtensionInstallForcelist), or equivalent MDM policy, ensuring auto-update is not blocked. Because exploitation requires a pre-existing renderer compromise, defenders should treat any indicator of renderer-level exploitation as the higher-severity upstream condition to remediate first - patching this CVE in isolation does not close renderer RCE vectors that would serve as preconditions. No effective workaround exists short of patching, as Skia is a core rendering component that cannot be disabled.