CVE-2026-10932

HighCVSS 8.8/10Last modified Jul 22, 2026

Description

Use after free in UI in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

No affected versions have been published.

Timeline

Published
Jun 4, 2026
Last modified
Jul 22, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-1093205.4The Grav API plugin (grav-plugin-api) before 1.0.36 contains an improper session validation vulnerability that allows disabled accounts to kCVE-2026-1093219.1Grav Login OAuth plugin (grav-plugin-login-oauth) before 1.4.3 provisions OAuth accounts as ordinary Grav users with a deterministic <providCVE-2026-1093226.1Grav Guestbook plugin before 0.5.2 contains a stored cross-site scripting vulnerability because its AJAX Load more and Admin Load all handleCVE-2026-1093235.3Grav Star Ratings 2.0.1 through 2.0.3 contains a missing authorization vulnerability that allows unauthenticated visitors to vote by bypassiCVE-2026-1093246.5Grav before 2.1.7 contains a denial of service vulnerability that allows authenticated media authors to exhaust memory by uploading compressCVE-2026-1093257.5Grav from 2.0.22 before 2.1.7 contains an authentication bypass vulnerability in the Clockwork profiler that trusts loopback REMOTE_ADDR valCVE-2026-1093267.5Grav before 2.1.7 contains an information disclosure vulnerability because bundled nginx, lighttpd, IIS, and Caddy 2 configurations block .gCVE-2026-1093276.1Admidio 4.0.12 through 4.3.17 and 5.0.0 before 5.0.15 contains a reflected cross-site scripting vulnerability in system/redirect.php that alCVE-2026-1093286.1Admidio 5.0.0 before 5.0.15 contains an unauthenticated stored cross-site scripting vulnerability in RegistrationPresenter.php, which insertCVE-2026-1093296.5Admidio 4.3.2 through 4.3.17 and 5.0.0 before 5.0.15 contains a broken access control vulnerability that allows role administrators to assigCVE-2026-109338.3Use after free in Audio in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer procesCVE-2026-1093304.3Network-AI 5.0.0 before 5.15.2 contains a cross-site WebSocket hijacking vulnerability in DashboardServer that allows remote attackers to re
CVE-2026-10932: High severity, CVSS 8.8 | Vulnix