CVE-2026-10931
A use‑after‑free bug in Google Chrome’s FileSystem API lets a remote attacker escape the browser sandbox by loading a specially crafted HTML page. The flaw can give the attacker full control over the user’s system.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Google Chrome browsers older than version 149.0.7827.53, i.e., any user running an outdated Chrome installation.
Real-world impact
An attacker could run arbitrary code on the victim’s computer, steal data, install malware, or take full control of the system.
Why this severity
The CVSS score of 9.6 reflects that the vulnerability is exploitable over the network, requires no user interaction beyond opening a page, and gives an attacker complete compromise of confidentiality, integrity, and availability.
What to do about it
- 01Upgrade Google Chrome to version 149.0.7827.53 or later.
- 02Restart the browser to ensure the update takes effect.
NVD-referenced vendor advisory
Timeline
- Jun 4, 2026 · Jun 4, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 22, 2026 · 13d agoAdvisory updatedThe NVD record was last revised.
- Jul 24, 2026 · 11d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
How it’s attacked
References & advisories
- chromereleases.googleblog.com/2026/06/stable-channel-upda…release notes
- issues.chromium.org/issues/501115599permissions required