This is sort of an anomalous stat since normally new visits should be lesser or equal to unique visitors for that period. However, you are making a mistake in your interpretation, so let's break it down. The data basically says this:
- 10 unique visitors:
- There were 10 hits (in this period) to your site where GA found no prior hits (in this period) for that visitor.
- So that means there was a total of 10 different users that visited your site in this period.
- 26 visits (11 new + 15 return):
- There were 26 different GA-identified browser sessions (in this period).
- 11 sessions were by users whom GA had never seen before.
- 15 sessions were by users whom GA has seen before.
Before we get to your edge case, let's address a more common case, where there are 10 new visits + 15 returning visits, but only 10 unique visitors:
Now, you might say, shouldn't there be at least 11 unique visitors since each new visit = 1 unique visitor, and all return visits together require at least another unique visitor? Well, no. A unique visitor can, in this case, contribute 0 or 1 new/first visits and an arbitrary number of return/subsequent visits. So at minimum, you'd only need as many unique visitors as you have new visits.
But wait, how on earth did you end up with 1 more new visit than unique visitors? That should be impossible!
Well, web analytics is an imperfect technology. There are many different data collection methods that have different advantages and drawbacks and relative accuracy versus convenience. GA chooses a relatively optimal balance of convenience and accessibility. It uses 3rd-party JavaScript/AJAX and browser cookies, which collects moderately accurate metrics without making webmasters install server-side scripting or packet and log analysis like heavy-duty analytics platforms like Pion.
The problem with this is that if the user disables JavaScript or clears or disables cookies, it throws off your metrics. If the user uses multiple browsers, it also throws off your metrics.
So how does this explain what's going on here? One possibility is that there was at least 1 user who had cookies disabled, and they had at least 1 session, creating a visit that couldn't be matched with a previous session, thus creating a new visit. And since cookies were disabled, they didn't register a new unique visitor.