CVE-2026-10972 is a use-after-free vulnerability (CWE-416) in the Ozone component of Google Chrome on Linux platforms. It affects versions prior to 149.0.7827.53 and can be triggered remotely via a specially crafted HTML page, potentially enabling sandbox escape. The vulnerability has a CVSS 3.1 base score of 9.6, indicating critical severity with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts confidentiality, integrity, and availability with scope change. The vendor advisory linked does not explicitly state if a fix is available or if users should take specific actions.

Successful exploitation could allow a remote attacker to escape the Chrome sandbox on Linux systems, potentially leading to full compromise of the affected system. The vulnerability impacts confidentiality, integrity, and availability at a critical level. No known active exploits have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Users should monitor official Google Chrome release notes and update to version 149.0.7827.53 or later once confirmed patched. Until then, exercise caution when browsing untrusted websites.