CVE-2026-10995 describes a heap buffer overflow in the TabStrip feature of Google Chrome before version 149.0.7827.53. Exploitation requires user interaction involving specific UI gestures on a maliciously crafted HTML page, which may cause heap corruption. The vulnerability is recognized by Chromium security as medium severity. No CVSS score or detailed remediation information is provided in the input data. The vendor advisory URL references a stable channel update but does not explicitly confirm a fix for this vulnerability.

Successful exploitation could result in heap corruption, which may lead to application instability or potentially enable further exploitation depending on the attacker's goals. However, exploitation requires user interaction with specific UI gestures, limiting the attack vector. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Until a confirmed patch is available, users should exercise caution when interacting with untrusted web content, especially involving unusual UI gestures. No official fix or temporary workaround is explicitly stated in the provided data.