CVE-2026-10021

Description

Insufficient validation of untrusted input in USB in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Medium)

Overview

State: —
Assigner (CNA): —
CVSS severity: MEDIUM
CVSS score: 5.0 / 10
CVSS vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Effective score: 5.0 / 10 MEDIUM source: CNA overview
CWE(s): —
Reserved: —
Published: 2026-06-01 00:00 UTC
Last updated: 2026-06-19 14:40 UTC
Source: https://www.rapid7.com/db/vulnerabilities/debian-cve-2026-10021/
Linked Threat: CVE-2026-10021 — CVE-2026-10021

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published: 2026-05-28 23:16:43 UTC
NVD last modified: 2026-07-21 10:10:00 UTC
NVD CVSS v3.1: 8.8 / 10 HIGH source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
NVD CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Exploitability subscore: 2.8 / 10
Impact subscore: 5.9 / 10
EPSS score: 0.0023 (probability of exploitation in next 30 days)
EPSS percentile: 14.38% vs all CVEs — higher = more likely to be exploited, as of 2026-07-27

NVD-assigned CWE(s): CWE-20 (differs from the CNA list above)

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2026-33163
Assigner: Chrome
Published: May 28, 2026, 10:25:57 PM
Updated: May 30, 2026, 3:55:20 AM
EUVD base score (CVSS 3.1): 8.8 / 10
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EUVD-reported EPSS: 0.2300
Vendors: Google
Products: Chrome (148.0.7778.216 <148.0.7778.216)
Aliases: GHSA-4jm4-gh3x-cq86

ENISA description: Insufficient validation of untrusted input in USB in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Medium)

EUVD references (2)

Microsoft Security Response Center MSRC

Microsoft's vendor-authoritative record from the Security Update Guide — its own CVSS score, impact, severity rating, exploit assessment, and KB-article fixes. Refreshed 2026-11-05 03:38 UTC (source: CVRF).

Release: 2026-May

Microsoft remediations / KB articles (2)

Release Notes — Vendor Fix / Security Update (fixed build 148.0.3967.96)
https://docs.microsoft.com/en-us/DeployEdge/microsoft-edge-relnotes-security — None Available / Release Notes

Microsoft FAQ (2)

What is the version information for this release?

Microsoft Edge Version	Date Released	Based on Chromium Version
148.0.3967.96	05/29/2026	148.0.7778.216/217

Why is this Chrome CVE included in the Security Update Guide?

The vulnerability assigned to this CVE is in Chromium Open Source Software (OSS) which is consumed by Microsoft Edge (Chromium-based). It is being documented in the Security Update Guide to announce that the latest version of Microsoft Edge (Chromium-based) is no longer vulnerable.

How can I see the version of the browser?

In your Microsoft Edge browser, click on the 3 dots (...) on the very right-hand side of the window
Click on Help and Feedback
Click on About Microsoft Edge

Affected products — CPE 2.3 (4) NVD

NVD's normalized CPE 2.3 matchers, used by vendor tools (vulnerability scanners, asset managers) for automated detection. Compare with the CNA's free-text "Affected products" section above.

cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*

Vendor references (0)

References embedded in the original CVE record by the assigning CNA.

None in the CVE record.

Web references (10)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

None Available msrc
MSRC update guide: CVE-2026-10021 msrc
https://www.first.org/epss/ tenable:www.first.org
https://issues.chromium.org/issues/497327715 tenable:issues.chromium.org
https://nvd.nist.gov/vuln/detail/CVE-2026-10021 tenable:nvd.nist.gov
https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html rapid7:chromereleases.googleblog.com
https://www.cve.org/CVERecord?id=CVE-2026-10021 rapid7:www.cve.org
https://attackerkb.com/topics/CVE-2026-10021 rapid7:attackerkb.com
http://cwe.mitre.org/data/definitions/20.html rapid7:cwe.mitre.org
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-33163 rapid7:euvd.enisa.europa.eu

NVD-tagged references (2)

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html chrome-cve-admin@google.com Vendor Advisory
https://issues.chromium.org/issues/497327715 chrome-cve-admin@google.com Permissions Required

Remediations (12)

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

Rapid7 — Solution

rapid7

google-chrome-upgrade-latest

2026-06-04 08:57 UTC
Rapid7 — Solution

rapid7

debian-upgrade-chromium

2026-06-04 08:54 UTC
FortiBleed - 70,000+ Fortinet Firewalls Compromised in Massive ...

web:cybersecuritynews.com

An exhaustive cyber espionage campaign now dubbed "FortiBleed" has silently compromised over 73,932 unique Fortinet firewall URLs across 194 countries.

2026-06-19 02:29 UTC
Online-Fix - Discord

web:discord.com

The Official Discord server of online- fix .me! Ask for help, games or just chat with others. Welcome <3 | 96339 members

2026-06-19 02:29 UTC
Fix it up Wiki | Fandom

web:fix-it-up.fandom.com

Fix It Up is a Roblox car repair simulator game developed by .workspace. Players buy or find broken cars, repair damaged parts, customize them, and sell them for profit.

2026-06-19 02:29 UTC
FIX Parser

web:fixparser.targetcompid.com

Paste FIX messages, drop a file (.log, .gz, .zip), or click Load file.

2026-06-19 02:29 UTC
SkyBlock Patch Notes | Hypixel Forums

web:hypixel.net

All SkyBlock Patch Notes can be found here! You can click the Watch button in this section to be alerted when new Patch Notes are released!

2026-06-19 02:29 UTC
Home - Lukat Detail

web:lukatdetail.com

Spent a few hours with the Lukat Fix It combo pack and some elbow grease and the old truck has been transformed into a respectable ""twenty footer", if you know what I mean. I started on the roof to get the hang of using the product so mistakes/learning experiences would be less visible.

2026-06-19 02:29 UTC
Interior Dept.: Reflecting Pool Fix Working Despite Algae Return

web:www.newsmax.com

Green algae have reappeared in the Lincoln Memorial Reflecting Pool just days after the Trump administration completed a more than $13 million renovation project, according to photographs cited Monday by The Hill.

2026-06-19 02:29 UTC
patch.moe - Age Verification

web:www.patch.moe

Age Verification Are you 18 years or older? YES NO

2026-06-19 02:29 UTC
Is hydrogen peroxide a pool fix? DC Reflecting pool algae explained - Yahoo

web:www.yahoo.com

Gallon jugs of hydrogen peroxide were dumped into the Lincoln Memorial Reflecting Pool. But will that fix the green algae? Here's what we know.

2026-06-19 02:29 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-10021.json.

Not stored.