CVE-2026-10993 is a heap buffer overflow vulnerability in the Skia graphics library used by Google Chrome. It affects Chrome versions before 149.0.7827.53 and can be triggered remotely via a specially crafted HTML page. Exploitation may lead to disclosure of sensitive information from process memory. The vulnerability has a CVSS 3.1 base score of 6.5, reflecting network attack vector, low attack complexity, no privileges required, user interaction needed, unchanged scope, high confidentiality impact, and no integrity or availability impact. There are no known exploits in the wild at this time. The vendor advisory linked indicates a stable channel update addressing this issue.

Successful exploitation allows a remote attacker to obtain potentially sensitive information from the memory of the Chrome process. There is no impact on integrity or availability. The vulnerability requires user interaction (visiting a malicious HTML page) and has a medium severity rating.

A fix is available in Google Chrome version 149.0.7827.53. Users and administrators should update to this version or later to remediate the vulnerability. Refer to the official Google Chrome stable channel update advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for details.