CVE-2026-10016 is a use-after-free vulnerability in the Document Object Model (DOM) of Google Chrome prior to version 148.0.7778.216. This vulnerability enables remote attackers to execute arbitrary code inside the sandbox by delivering a specially crafted HTML page. The vulnerability carries a high severity rating with a CVSS 3.1 base score of 8.8, reflecting network attack vector, low attack complexity, no privileges required, user interaction needed, unchanged scope, and high impact on confidentiality, integrity, and availability. The issue was publicly disclosed on May 28, 2026, and fixed in Chrome 148.0.7778.216. No known active exploitation has been reported.

Successful exploitation of this vulnerability could allow remote attackers to execute arbitrary code within the sandbox environment of the affected Chrome browser, potentially leading to compromise of browser security and user data confidentiality, integrity, and availability. The high CVSS score reflects the significant impact if exploited. However, no known exploits in the wild have been reported at this time.

Google has released Chrome version 148.0.7778.216 which addresses this vulnerability. Users and administrators should update affected Chrome installations to this version or later to remediate the issue. Since this is a client-side vulnerability, updating the browser is the primary and recommended mitigation. Patch status is confirmed by the vendor advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html.