PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-10925 Google CVE debrief

CVE-2026-10925 is a High-severity vulnerability in Google Chrome on Mac, allowing a remote attacker to potentially perform a sandbox escape via a crafted HTML page. The vulnerability is caused by an out-of-bounds write in Skia.

Vendor
Google
Product
Chrome
CVSS
HIGH 8.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-04
Original CVE updated
2026-06-05
Advisory published
2026-06-04
Advisory updated
2026-06-05

Who should care

Users of Google Chrome on Mac, particularly those who browse the web and may encounter crafted HTML pages.

Technical summary

The vulnerability is caused by an out-of-bounds write in Skia, a graphics library used by Google Chrome. An attacker who has compromised the renderer process could potentially exploit this vulnerability to perform a sandbox escape via a crafted HTML page.

Defensive priority

High

Recommended defensive actions

  • Update Google Chrome to version 149.0.7827.53 or later.
  • Be cautious when browsing the web and avoid encountering suspicious or crafted HTML pages.

Evidence notes

The vulnerability was reported by an anonymous researcher and is tracked by CVE-2026-10925.

Official resources

CVE-2026-10925 was published on 2026-06-04T23:16:54.870Z and modified on 2026-06-05T15:46:48.563Z.