PatchSiren cyber security CVE debrief
CVE-2026-10895 Google CVE debrief
CVE-2026-10895 is a high-severity vulnerability in Google Chrome prior to version 149.0.7827.53. This use-after-free issue in the Ozone component allows remote attackers to execute arbitrary code via a crafted HTML page. The vulnerability has a CVSS score of 8.8 and is classified as HIGH.
- Vendor
- Product
- Chrome
- CVSS
- HIGH 8.8
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-06-04
- Original CVE updated
- 2026-06-05
- Advisory published
- 2026-06-04
- Advisory updated
- 2026-06-05
Who should care
Users of Google Chrome prior to version 149.0.7827.53 should update to the latest version to mitigate this vulnerability.
Technical summary
The vulnerability is a use-after-free issue in the Ozone component of Google Chrome. This type of vulnerability occurs when a program attempts to access memory that has already been freed or deleted. In this case, a remote attacker can exploit this vulnerability by providing a crafted HTML page that triggers the use-after-free condition, allowing the attacker to execute arbitrary code.
Defensive priority
High
Recommended defensive actions
- Update Google Chrome to version 149.0.7827.53 or later.
Evidence notes
The CVE record and NVD detail can be found at [cve-org] and [nvd], respectively.
Official resources
-
CVE-2026-10895 CVE record
CVE.org
-
CVE-2026-10895 NVD detail
NVD
-
Source item URL
nvd_modified
-
Mitigation or vendor reference
[email protected] - Release Notes, Vendor Advisory
-
Source reference
[email protected] - Permissions Required
CVE-2026-10895 was published on [cvePublishedAt] and modified on [cveModifiedAt].