CVE-2026-10973
Published: 04 June 2026
Summary
CVE-2026-10973 is a high-severity Use of Uninitialized Variable (CWE-457) vulnerability in Google Chrome. Its CVSS base score is 7.4 (High).
Operationally, ranked in the top 46.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The vulnerability is an uninitialized use flaw (CWE-457) in the Dawn component of Google Chrome versions prior to 149.0.7827.53. It carries a CVSS 3.1 score of 7.4 and was rated High severity by the Chromium project, affecting the browser's ability to safely handle certain graphics-related operations before memory initialization occurs.
A remote attacker can exploit the issue by serving a crafted HTML page that triggers the uninitialized memory access. Successful exploitation allows leakage of cross-origin data, with the attack requiring user interaction via the UI but operating over the network with no privileges needed and changed scope in the CVSS model.
The referenced Chrome stable channel update and associated Chromium issue tracker entry indicate that the flaw is resolved by upgrading to version 149.0.7827.53 or later.
The EPSS score has remained flat at 0.0482 with no material rise after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-34422
Vulnerability details
Uninitialized Use in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.