What is the CVSS score of EUVD-2026-34435?

EUVD-2026-34435 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by EUVD-2026-34435?

Google Chrome versions before 149.0.7827.53 contain a high-severity remote code execution flaw that allows attackers to compromise employee workstations through media files or malicious websites.. A patch is available.

How to fix or mitigate EUVD-2026-34435?

Within 24 hours: Inventory all Chrome deployments and identify systems running versions prior to 149.0.7827.53; disable media autoplay in Chrome settings and alert users to avoid opening media files from untrusted sources. Within 7 days: Deploy Google Chrome version 149.0.7827.53 or later via endpoint management to all Windows, macOS, and Linux workstations, prioritizing high-risk roles. Within 30 days: Verify 100% compliance with Chrome 149.0.7827.53 or later and review browser update policies to enable automatic Chrome updates.

Google Chrome EUVD-2026-34435

| CVE-2026-10986 HIGH

External Control of Assumed-Immutable Web Parameter (CWE-472)

2026-06-04 chrome-cve-admin@google.com

GHSA-2cfc-cqv5-w2wq

RCE Google

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 02:58 vuln.today

CVSS changed

Jun 05, 2026 - 02:22 NVD

8.8 (HIGH)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

HIGH 8.8

DescriptionCVE.org

Integer overflow in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a malicious file. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome versions prior to 149.0.7827.53 allows a remote attacker to execute arbitrary code within the renderer sandbox by delivering a malicious media file. The flaw is rated High severity by Chromium and carries a CVSS 3.1 score of 8.8, requiring only that a user visit attacker-controlled content or open a crafted media resource. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.

Technical ContextAI

The vulnerability resides in Chrome's Media component, which handles parsing and decoding of audio/video container formats and codecs within the browser. The CWE-472 classification (External Control of Assumed-Immutable Web Parameter) is somewhat atypical for a media integer overflow; the practical root cause is an integer overflow during media processing that leads to memory corruption and code execution constrained to the renderer/sandbox process. Chromium's Media stack runs inside the sandboxed renderer, so successful exploitation yields code execution inside that sandbox boundary - a separate sandbox escape would be needed to reach the host OS.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.53 - upgrade Chrome Stable to 149.0.7827.53 or later on all desktop platforms via the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html and force-restart browsers to apply the update. Administrators using Chromium-based browsers should monitor their respective vendors (Microsoft Edge, Brave, Opera, Vivaldi) for corresponding builds that rebase onto the patched Chromium. As a compensating control until patches are deployed, restrict autoplay and media loading from untrusted origins via enterprise policy (e.g., DefaultAutoplayPolicy, URLBlocklist for known-bad domains) and consider enabling Site Isolation strictly - note that disabling media features entirely (audio/video) will break legitimate web functionality and is generally not viable for production fleets. Additional details are tracked at https://issues.chromium.org/issues/514744613.