# CVE-2026-10941: Chromium: CVE-2026-10941 Out of bounds memory access in Skia CVE-2026-10941 is fixed in 17 products on 3 platforms, first by Google Chrome Dev (EXE) 150.0.7828.2, released May 6, 2026. It is not reported as exploited. Patch Radar priority: High. - Web page: https://patchblox.com/security/cve/CVE-2026-10941 - Priority: High - CVSS: 9.6 (high) - EPSS: 0.0044 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Jun 4, 2026 - Weakness: CWE-125: Out-of-bounds Read - Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-10941 ## Description

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Windows apps | Google Chrome (EXE) | 149.0.7827.54 | [Google Chrome (EXE) 149.0.7827.54](https://patchblox.com/security/data/fix/windows-app/google.chrome.exe-149.0.7827.54.md) | May 29, 2026 | | Windows apps | Google Chrome Beta (EXE) | 149.0.7827.53 | [Google Chrome Beta (EXE) 149.0.7827.53](https://patchblox.com/security/data/fix/windows-app/google.chrome.beta.exe-149.0.7827.53.md) | May 29, 2026 | | Windows apps | Google Chrome Dev (EXE) | 150.0.7828.2 | [Google Chrome Dev (EXE) 150.0.7828.2](https://patchblox.com/security/data/fix/windows-app/google.chrome.dev.exe-150.0.7828.2.md) | May 6, 2026 | | Windows apps | Microsoft Edge | 149.0.4022.52 | [Microsoft Edge 149.0.4022.52](https://patchblox.com/security/data/fix/windows-app/microsoft.edge-149.0.4022.52.md) | Jun 4, 2026 | | Windows apps | Microsoft Edge Beta | 151.0.4129.59 | [Microsoft Edge Beta 151.0.4129.59](https://patchblox.com/security/data/fix/windows-app/microsoft.edge.beta-151.0.4129.59.md) | Jul 31, 2026 | | Windows apps | Microsoft Edge Dev | 152.0.4167.0 | [Microsoft Edge Dev 152.0.4167.0](https://patchblox.com/security/data/fix/windows-app/microsoft.edge.dev-152.0.4167.0.md) | Jul 20, 2026 | | Windows apps | Microsoft Edge WebView2 Runtime | 149.0.4022.52 | [Microsoft Edge WebView2 Runtime 149.0.4022.52](https://patchblox.com/security/data/fix/windows-app/microsoft.edgewebview2runtime-149.0.4022.52.md) | Jun 4, 2026 | | macOS | Google Chrome | 149.0.7827.156 | [Google Chrome 149.0.7827.156](https://patchblox.com/security/data/fix/macos/com.google.chrome-149.0.7827.156.md) | Jun 16, 2026 | | macOS | Microsoft Edge | 149.0.4022.80 | [Microsoft Edge 149.0.4022.80](https://patchblox.com/security/data/fix/macos/com.microsoft.edgemac-149.0.4022.80.md) | Jun 17, 2026 | | Linux | chromium Debian 12.15 (bookworm) | 149.0.7827.53-1~deb12u1 | [DEBIAN-CVE-2026-10941](https://patchblox.com/security/data/fix/linux/debian-cve-2026-10941.md) | Jun 24, 2026 | | Linux | chromium Debian 13.5 (trixie) | 149.0.7827.53-1~deb13u1 | [DEBIAN-CVE-2026-10941](https://patchblox.com/security/data/fix/linux/debian-cve-2026-10941.md) | Jun 24, 2026 | | Linux | chromium Debian 14 | 149.0.7827.53-1 | [DEBIAN-CVE-2026-10941](https://patchblox.com/security/data/fix/linux/debian-cve-2026-10941.md) | Jun 24, 2026 | | Linux | chromium opensuse-leap 16.0 | 149.0.7827.155-bp160.1.1 | [OPENSUSE-SU-2026:21135-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21135-1.md) | Aug 31, 2026 | | Linux | webkit2gtk Debian 13.5 (trixie) | 2.54.0-1~deb13u1 | [DEBIAN-CVE-2026-10941](https://patchblox.com/security/data/fix/linux/debian-cve-2026-10941.md) | Jun 24, 2026 | | Linux | webkit2gtk3 RHEL 8 | 0:2.54.0-1.el8_10 | [RHSA-2026:74084](https://patchblox.com/security/data/fix/linux/rhsa-2026-74084.md) | Jul 21, 2026 | | Linux | webkit2gtk3 almalinux 8 | 2.54.0-1.el8_10 | [ALSA-2026:74084](https://patchblox.com/security/data/fix/linux/alsa-2026-74084.md) | Sep 30, 2026 | | Linux | webkit2gtk3 almalinux 9 | 2.54.0-1.el9_8 | [ALSA-2026:69098](https://patchblox.com/security/data/fix/linux/alsa-2026-69098.md) | Sep 21, 2026 | | Linux | webkit2gtk3 ol 8 | 0:2.54.0-1.el8_10 | [ELSA-2026-74084](https://patchblox.com/security/data/fix/linux/elsa-2026-74084.md) | Oct 1, 2026 | | Linux | webkit2gtk3 opensuse-leap 16.0 | 2.54.1-160000.1.1 | [OPENSUSE-SU-2026:22076-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-22076-1.md) | Nov 7, 2026 | | Linux | webkit2gtk3 rocky 8 | 0:2.54.0-1.el8_10 | [RLSA-2026:74084](https://patchblox.com/security/data/fix/linux/rlsa-2026-74084.md) | Oct 1, 2026 | | Linux | webkit2gtk3 rocky 9 | 0:2.54.0-1.el9_8 | [RLSA-2026:69098](https://patchblox.com/security/data/fix/linux/rlsa-2026-69098.md) | Sep 22, 2026 | | Linux | webkit2gtk3 sles 15.6 | 2.54.1-150600.12.81.3 | [SUSE-SU-2026:4858-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4858-1.md) | Nov 7, 2026 | | Linux | webkit2gtk3 sles 15.7 | 2.54.1-150600.12.81.3 | [SUSE-SU-2026:4858-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4858-1.md) | Nov 7, 2026 | | Linux | webkit2gtk3 sles 16.0 | 2.54.1-160000.1.1 | [SUSE-SU-2026:24225-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-24225-1.md) | Nov 7, 2026 | | Linux | webkit2gtk3-devel RHEL 8 | 0:2.54.0-1.el8_10 | [RHSA-2026:74084](https://patchblox.com/security/data/fix/linux/rhsa-2026-74084.md) | Jul 21, 2026 | | Linux | webkit2gtk3-devel almalinux 8 | 2.54.0-1.el8_10 | [ALSA-2026:74084](https://patchblox.com/security/data/fix/linux/alsa-2026-74084.md) | Sep 30, 2026 | | Linux | webkit2gtk3-devel almalinux 9 | 2.54.0-1.el9_8 | [ALSA-2026:69098](https://patchblox.com/security/data/fix/linux/alsa-2026-69098.md) | Sep 21, 2026 | | Linux | webkit2gtk3-devel ol 8 | 0:2.54.0-1.el8_10 | [ELSA-2026-74084](https://patchblox.com/security/data/fix/linux/elsa-2026-74084.md) | Oct 1, 2026 | | Linux | webkit2gtk3-jsc RHEL 8 | 0:2.54.0-1.el8_10 | [RHSA-2026:74084](https://patchblox.com/security/data/fix/linux/rhsa-2026-74084.md) | Jul 21, 2026 | | Linux | webkit2gtk3-jsc almalinux 8 | 2.54.0-1.el8_10 | [ALSA-2026:74084](https://patchblox.com/security/data/fix/linux/alsa-2026-74084.md) | Sep 30, 2026 | | Linux | webkit2gtk3-jsc almalinux 9 | 2.54.0-1.el9_8 | [ALSA-2026:69098](https://patchblox.com/security/data/fix/linux/alsa-2026-69098.md) | Sep 21, 2026 | | Linux | webkit2gtk3-jsc ol 8 | 0:2.54.0-1.el8_10 | [ELSA-2026-74084](https://patchblox.com/security/data/fix/linux/elsa-2026-74084.md) | Oct 1, 2026 | | Linux | webkit2gtk3-jsc-devel RHEL 8 | 0:2.54.0-1.el8_10 | [RHSA-2026:74084](https://patchblox.com/security/data/fix/linux/rhsa-2026-74084.md) | Jul 21, 2026 | | Linux | webkit2gtk3-jsc-devel almalinux 8 | 2.54.0-1.el8_10 | [ALSA-2026:74084](https://patchblox.com/security/data/fix/linux/alsa-2026-74084.md) | Sep 30, 2026 | | Linux | webkit2gtk3-jsc-devel almalinux 9 | 2.54.0-1.el9_8 | [ALSA-2026:69098](https://patchblox.com/security/data/fix/linux/alsa-2026-69098.md) | Sep 21, 2026 | | Linux | webkit2gtk3-jsc-devel ol 8 | 0:2.54.0-1.el8_10 | [ELSA-2026-74084](https://patchblox.com/security/data/fix/linux/elsa-2026-74084.md) | Oct 1, 2026 | | Linux | webkit2gtk3-soup2 opensuse-leap 16.0 | 2.54.1-160000.1.1 | [OPENSUSE-SU-2026:22076-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-22076-1.md) | Nov 7, 2026 | | Linux | webkit2gtk3-soup2 sles 15.6 | 2.54.1-150600.12.81.4 | [SUSE-SU-2026:4858-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4858-1.md) | Nov 7, 2026 | | Linux | webkit2gtk3-soup2 sles 15.7 | 2.54.1-150600.12.81.4 | [SUSE-SU-2026:4858-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4858-1.md) | Nov 7, 2026 | | Linux | webkit2gtk4 opensuse-leap 16.0 | 2.54.1-160000.1.1 | [OPENSUSE-SU-2026:22076-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-22076-1.md) | Nov 7, 2026 | | Linux | webkit2gtk4 sles 15.6 | 2.54.1-150600.12.81.4 | [SUSE-SU-2026:4858-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4858-1.md) | Nov 7, 2026 | | Linux | webkit2gtk4 sles 15.7 | 2.54.1-150600.12.81.4 | [SUSE-SU-2026:4858-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4858-1.md) | Nov 7, 2026 | | Linux | webkit2gtk4 sles 16.0 | 2.54.1-160000.1.1 | [SUSE-SU-2026:24225-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-24225-1.md) | Nov 7, 2026 | | Linux | wpewebkit Debian 14 | 2.54.0-1 | [DEBIAN-CVE-2026-10941](https://patchblox.com/security/data/fix/linux/debian-cve-2026-10941.md) | Jun 24, 2026 | --- Data as of 2026-11-07T12:40:37Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo