CVE-2026-10995

chromium-browser: Heap buffer overflow in TabStrip

View on CVE.org
Published Jun 4, 2026 CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Description
Heap buffer overflow in TabStrip in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)

Analysis

AI-generated

Technical impact

A heap buffer overflow in the TabStrip component of Google Chrome allows a remote attacker, after convincing a user to perform specific UI gestures, to corrupt the browser’s heap. This corruption can lead to heap corruption and potentially other disruptive behavior, and is classified as a high severity flaw according to its CVSS score of 8.8. This flaw manifests as a heap buffer overflow (CWE-120) and a heap-based buffer overflow (CWE-122).

Affected Systems

Google Chrome versions prior to 149.0.7827.53 are affected. Users running these builds are at risk until the vulnerability is addressed.

Risk and Exploitability

The EPSS score is < 1% and it is not listed in the CISA KEV catalog, indicating limited current exploitation activity. The vulnerability requires a user to interact with a crafted HTML page and perform certain UI gestures, so exploitation would depend on social engineering. The CVSS score of 8.8 indicates high severity, underscoring the importance of timely mitigation. The vulnerability exploits buffer overflow weaknesses identified as CWE-120 / CWE-122.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Google Chrome to version 149.0.7827.53 or later.
  • Configure Chrome to update automatically to ensure the latest security patches are applied.
  • Exercise caution with links that prompt unconventional mouse or keyboard gestures and avoid engaging with untrusted content.

Generated by OpenCVE AI on June 7, 2026 at 13:58 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DSA Debian DSA DSA-6325-1 chromium security update
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Title chromium-browser: Heap buffer overflow in TabStrip
Weaknesses CWE-120
References
Metrics threat_severity

None

 threat_severity

Moderate
Type Values Removed Values Added
Title Heap Buffer Overflow in TabStrip Leading to Potential Remote Exploitation
Type Values Removed Values Added
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}
Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome
Type Values Removed Values Added
Title Heap Buffer Overflow in TabStrip Leading to Potential Remote Exploitation
Type Values Removed Values Added
Description Heap buffer overflow in TabStrip in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
Weaknesses CWE-122
References
Earlier changes (2)
Weaknesses
  • CWE-120

    Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

  • CWE-122

    Heap-based Buffer Overflow

Sources

Status
PUBLISHED
Assigner
Chrome
Published
Updated
Jun 8, 2026, 4:35 PM
Reserved
Jun 4, 2026, 5:06 PM

View source JSON

Updated
Jun 8, 2026, 4:34 PM

JSON

Status
Modified
Published
Jun 4, 2026, 11:17 PM
Modified
Jul 22, 2026, 8:10 PM

View source JSON

Severity
Moderate
Public date
Jun 2, 2026, 12:00 AM

View source Bugzilla JSON

Updated
Jun 7, 2026, 2:00 PM

JSON