CVE-2026-10891

HighCVSS 8.8/10Last modified Jul 22, 2026

Description

Use after free in GFX in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

No affected versions have been published.

Timeline

Published: Jun 4, 2026
Last modified: Jul 22, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-1089137.1omarchy-theme-set in Omarchy 4 before 4.0.1 allows code execution via a third-party theme because the files placed into ~/.local/state/omarc CVE-2026-1089149.9A flaw has been found in Edimax BR-6208AC 1.32. Affected by this issue is some unknown functionality of the file /goform/formWlSiteSurvey. T CVE-2026-1089159.9A vulnerability has been found in Edimax BR-6208AC 1.32. This affects an unknown part of the file /goform/formWlanMP. Such manipulation of t CVE-2026-1089168.3A vulnerability was found in Edimax BR-6208AC 1.32. This vulnerability affects unknown code of the file /goform/formAccept. Performing a man CVE-2026-10891710.0A vulnerability was determined in Edimax BR-6208AC 1.32. This issue affects some unknown processing of the file /goform/formAutoFWupgrade. E CVE-2026-10891810.0A vulnerability was identified in Edimax BR-6208AC 1.32. Impacted is an unknown function of the file /goform/formWlanMP. The manipulation of CVE-2026-1089194.3A weakness has been identified in SourceCodester Drug Recommendation System 1.0. The impacted element is an unknown function of the file Aut CVE-2026-108929.6Out of bounds write in GPU in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox esc CVE-2026-1089204.3A security vulnerability has been detected in SourceCodester Drug Recommendation System 1.0. This affects an unknown function of the file Ad CVE-2026-1089217.3A vulnerability was detected in KusalkaSilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. This impacts the fun CVE-2026-1089226.3A flaw has been found in KusalkaSilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. Affected is the function ge CVE-2026-1089236.3A vulnerability was determined in 1024-lab smart-admin up to 3.30.0. Affected by this vulnerability is an unknown functionality of the file