CVE-2026-10947 is a use-after-free vulnerability in the WebRTC module of Google Chrome before version 149.0.7827.53. It enables remote code execution inside the sandbox via a malicious HTML page. The vulnerability is rated high severity with a CVSS 3.1 score of 8.8, reflecting its potential to compromise confidentiality, integrity, and availability without requiring privileges but needing user interaction. The vendor advisory URL points to a Chrome stable channel update blog, but no explicit patch or remediation details are provided in the input data.

Successful exploitation allows a remote attacker to execute arbitrary code within the sandboxed environment of Google Chrome, potentially compromising the confidentiality, integrity, and availability of the affected system. This could lead to unauthorized actions or data exposure within the browser context. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Users should update Google Chrome to version 149.0.7827.53 or later once confirmed to contain the fix. Until then, exercise caution when visiting untrusted websites, especially those leveraging WebRTC features.