CVE-2026-10941
Chromium: CVE-2026-10941 Out of bounds memory access in Skia
CVE-2026-10941 is fixed in 17 products on 3 platforms, first by Google Chrome Dev (EXE) 150.0.7828.2, released May 6, 2026. It is not reported as exploited. Patch Radar priority: High.
HighFixed on 3 platforms
CVSS
9.6
high
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0044
38th percentile
<p>This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.</p>
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Windows apps | |||
| Google Chrome (EXE) | 149.0.7827.54 | Google Chrome (EXE) 149.0.7827.54 | May 29, 2026 |
| Google Chrome Beta (EXE) | 149.0.7827.53 | Google Chrome Beta (EXE) 149.0.7827.53 | May 29, 2026 |
| Google Chrome Dev (EXE) | 150.0.7828.2 | Google Chrome Dev (EXE) 150.0.7828.2 | May 6, 2026 |
| Microsoft Edge | 149.0.4022.52 | Microsoft Edge 149.0.4022.52 | Jun 4, 2026 |
| Microsoft Edge Beta | 151.0.4129.59 | Microsoft Edge Beta 151.0.4129.59 | Jul 31, 2026 |
| Microsoft Edge Dev | 152.0.4167.0 | Microsoft Edge Dev 152.0.4167.0 | Jul 20, 2026 |
| Microsoft Edge WebView2 Runtime | 149.0.4022.52 | Microsoft Edge WebView2 Runtime 149.0.4022.52 | Jun 4, 2026 |
| macOS | |||
| Google Chrome | 149.0.7827.156 | Google Chrome 149.0.7827.156 | Jun 16, 2026 |
| Microsoft Edge | 149.0.4022.80 | Microsoft Edge 149.0.4022.80 | Jun 17, 2026 |
| Linux | |||
| chromium · Debian 12.15 (bookworm) | 149.0.7827.53-1~deb12u1 | DEBIAN-CVE-2026-10941 | Jun 24, 2026 |
| chromium · Debian 13.5 (trixie) | 149.0.7827.53-1~deb13u1 | DEBIAN-CVE-2026-10941 | Jun 24, 2026 |
| chromium · Debian 14 | 149.0.7827.53-1 | DEBIAN-CVE-2026-10941 | Jun 24, 2026 |
| chromium · opensuse-leap 16.0 | 149.0.7827.155-bp160.1.1 | OPENSUSE-SU-2026:21135-1 | Aug 31, 2026 |
| webkit2gtk · Debian 13.5 (trixie) | 2.54.0-1~deb13u1 | DEBIAN-CVE-2026-10941 | Jun 24, 2026 |
| webkit2gtk3 · RHEL 8 | 0:2.54.0-1.el8_10 | RHSA-2026:74084 | Jul 21, 2026 |
| webkit2gtk3 · almalinux 8 | 2.54.0-1.el8_10 | ALSA-2026:74084 | Sep 30, 2026 |
| webkit2gtk3 · almalinux 9 | 2.54.0-1.el9_8 | ALSA-2026:69098 | Sep 21, 2026 |
| webkit2gtk3 · ol 8 | 0:2.54.0-1.el8_10 | ELSA-2026-74084 | Oct 1, 2026 |
| webkit2gtk3 · opensuse-leap 16.0 | 2.54.1-160000.1.1 | OPENSUSE-SU-2026:22076-1 | Nov 7, 2026 |
| webkit2gtk3 · rocky 8 | 0:2.54.0-1.el8_10 | RLSA-2026:74084 | Oct 1, 2026 |
| webkit2gtk3 · rocky 9 | 0:2.54.0-1.el9_8 | RLSA-2026:69098 | Sep 22, 2026 |
| webkit2gtk3 · sles 15.6 | 2.54.1-150600.12.81.3 | SUSE-SU-2026:4858-1 | Nov 7, 2026 |
| webkit2gtk3 · sles 15.7 | 2.54.1-150600.12.81.3 | SUSE-SU-2026:4858-1 | Nov 7, 2026 |
| webkit2gtk3 · sles 16.0 | 2.54.1-160000.1.1 | SUSE-SU-2026:24225-1 | Nov 7, 2026 |
| webkit2gtk3-devel · RHEL 8 | 0:2.54.0-1.el8_10 | RHSA-2026:74084 | Jul 21, 2026 |
| webkit2gtk3-devel · almalinux 8 | 2.54.0-1.el8_10 | ALSA-2026:74084 | Sep 30, 2026 |
| webkit2gtk3-devel · almalinux 9 | 2.54.0-1.el9_8 | ALSA-2026:69098 | Sep 21, 2026 |
| webkit2gtk3-devel · ol 8 | 0:2.54.0-1.el8_10 | ELSA-2026-74084 | Oct 1, 2026 |
| webkit2gtk3-jsc · RHEL 8 | 0:2.54.0-1.el8_10 | RHSA-2026:74084 | Jul 21, 2026 |
| webkit2gtk3-jsc · almalinux 8 | 2.54.0-1.el8_10 | ALSA-2026:74084 | Sep 30, 2026 |
| webkit2gtk3-jsc · almalinux 9 | 2.54.0-1.el9_8 | ALSA-2026:69098 | Sep 21, 2026 |
| webkit2gtk3-jsc · ol 8 | 0:2.54.0-1.el8_10 | ELSA-2026-74084 | Oct 1, 2026 |
| webkit2gtk3-jsc-devel · RHEL 8 | 0:2.54.0-1.el8_10 | RHSA-2026:74084 | Jul 21, 2026 |
| webkit2gtk3-jsc-devel · almalinux 8 | 2.54.0-1.el8_10 | ALSA-2026:74084 | Sep 30, 2026 |
| webkit2gtk3-jsc-devel · almalinux 9 | 2.54.0-1.el9_8 | ALSA-2026:69098 | Sep 21, 2026 |
| webkit2gtk3-jsc-devel · ol 8 | 0:2.54.0-1.el8_10 | ELSA-2026-74084 | Oct 1, 2026 |
| webkit2gtk3-soup2 · opensuse-leap 16.0 | 2.54.1-160000.1.1 | OPENSUSE-SU-2026:22076-1 | Nov 7, 2026 |
| webkit2gtk3-soup2 · sles 15.6 | 2.54.1-150600.12.81.4 | SUSE-SU-2026:4858-1 | Nov 7, 2026 |
| webkit2gtk3-soup2 · sles 15.7 | 2.54.1-150600.12.81.4 | SUSE-SU-2026:4858-1 | Nov 7, 2026 |
| webkit2gtk4 · opensuse-leap 16.0 | 2.54.1-160000.1.1 | OPENSUSE-SU-2026:22076-1 | Nov 7, 2026 |
| webkit2gtk4 · sles 15.6 | 2.54.1-150600.12.81.4 | SUSE-SU-2026:4858-1 | Nov 7, 2026 |
| webkit2gtk4 · sles 15.7 | 2.54.1-150600.12.81.4 | SUSE-SU-2026:4858-1 | Nov 7, 2026 |
| webkit2gtk4 · sles 16.0 | 2.54.1-160000.1.1 | SUSE-SU-2026:24225-1 | Nov 7, 2026 |
| wpewebkit · Debian 14 | 2.54.0-1 | DEBIAN-CVE-2026-10941 | Jun 24, 2026 |