CVE-2026-10998
Low
No strong exploitation signal.
CVSS base
4.0
MEDIUM
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS — probability of exploitation (30 days)
0.1%
1.3th percentile
CISA KEV
Not listed
Weakness / dates
CWE-125
Published 2026-06-04 · modified 2026-07-22
CVSS breakdown
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
| Attack Vector | L | Local |
| Attack Complexity | L | Low |
| Privileges Required | N | None |
| User Interaction | N | None |
| Scope | U | Unchanged |
| Confidentiality | L | Low |
| Integrity | N | None |
| Availability | N | None |
Timeline
- 2026-06-04 — Published (NVD)
- 2026-07-22 — Last modified (NVD)
Description
Out of bounds read in Media in Google Chrome prior to 149.0.7827.53 allowed an attacker on the local network segment to perform an out of bounds memory read via malicious network traffic. (Chromium security severity: Medium)