CVE-2026-10961
High · CVSS 8.3 (CVSS 3.1)EPSS n/aPublished Updated Assigner: Chrome
Description
Use after free in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H · CWE-416
Status incidents that name it
- · No impact listed · names this CVE
“…PHP Remote Code Execution Vulnerabilities We can confirm that remediation efforts for the reported vulnerabilities, CVE-2026-109618 and CVE-2026-109619, were completed as of 20:06 UTC on October 23, 2026.We have found no evidence that these…”
Affected vendors and products
Google: Chrome
References
- CVE record on cve.org (opens in new tab)
- NVD entry (opens in new tab)
- chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html (opens in new tab)
- issues.chromium.org/issues/508281950 (opens in new tab)
- CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
- This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
- Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
- EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)