CVE-2026-10941 is an out of bounds memory access vulnerability in the Skia component of Google Chrome before version 149.0.7827.53. This vulnerability allows remote attackers to execute arbitrary code inside the sandbox via a crafted HTML page. The issue is categorized under CWE-125 (Out-of-bounds Read) and CWE-787 (Out-of-bounds Write). The CVSS v3.1 base score is 8.8, indicating a high-severity remote code execution flaw with network attack vector, low attack complexity, no privileges required, and user interaction needed. The vendor advisory is available but does not explicitly confirm patch status or remediation level. The affected versions are those prior to 149.0.7827.53, suggesting that upgrading to this version addresses the vulnerability.

Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code within the sandbox of the affected Chrome browser, potentially compromising confidentiality, integrity, and availability of the user's environment. The CVSS score of 8.8 indicates high impact. There are no known exploits in the wild currently. The vulnerability affects Chrome versions before 149.0.7827.53.

The vendor advisory linked indicates a stable channel update for desktop Chrome but does not explicitly state the remediation level or patch availability. Given the affected version is prior to 149.0.7827.53, updating to Chrome version 149.0.7827.53 or later is strongly recommended to mitigate this vulnerability. Patch status is not yet confirmed explicitly in the advisory; users should verify the update status via the official Chrome release notes or update mechanism.