What is the CVSS score of CVE-2026-13021?

CVE-2026-13021 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-13021?

Yes, a patch is available for CVE-2026-13021. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-13021

EUVD-2026-39036 MEDIUM

Origin Validation Error (CWE-346)

2026-06-24 Chrome

GHSA-xrw9-98j7-cc8w

Authentication Bypass Google Red Hat

4.3

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network-delivered via crafted HTML requiring active user visit (UI:R); SOP bypass yields only limited cross-origin data read with no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 24, 2026 - 21:39 vuln.today

CVSS changed

Jun 24, 2026 - 20:22 NVD

4.3 (MEDIUM)

CVE Published

Jun 24, 2026 - 18:43 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 24, 2026 - 18:43 cve.org

MEDIUM 4.3

DescriptionCVE.org

Inappropriate implementation in DeviceBoundSessionCredentials in Google Chrome prior to 149.0.7827.197 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Same-origin policy bypass in Google Chrome's DeviceBoundSessionCredentials (DBSC) feature affects all Chrome versions prior to 149.0.7827.197, allowing a remote attacker to read limited cross-origin data via a crafted HTML page. The flaw stems from incorrect origin validation (CWE-346) in the DBSC implementation, a relatively new anti-session-hijacking subsystem. SSVC assessment confirms no exploitation at time of analysis, and no public exploit code has been identified; the CVSS score of 4.3 Medium reflects meaningful but bounded confidentiality impact contingent on user interaction.

Technical ContextAI

DeviceBoundSessionCredentials (DBSC) is a Chrome feature designed to cryptographically bind session tokens to a specific device, mitigating session cookie theft. CWE-346 (Origin Validation Error) indicates the root cause is an improper check of the origin associated with a session credential request or response, which undermines the same-origin policy that isolates cross-site resources. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covering all platform variants of Chrome prior to version 149.0.7827.197. Because DBSC is a newer browser-level security layer, inappropriate implementation can create a trust boundary gap that a crafted HTML page can exploit to influence or observe credential-bound session behavior across origins.

RemediationAI

The primary fix is to update Google Chrome to version 149.0.7827.197 or later, which contains the corrected DeviceBoundSessionCredentials implementation. The vendor-released stable channel advisory is at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0482630350.html and the upstream issue tracker reference is https://issues.chromium.org/issues/511776603. For enterprise environments where immediate patching is delayed, a compensating control is to restrict Chrome's use of the DBSC feature via enterprise policy if such a toggle is available in managed Chrome deployments - note that disabling DBSC removes its session-binding security benefit, which is a meaningful trade-off in high-value environments. No workaround eliminates the SOP bypass without patching; user education to avoid untrusted pages is not a reliable mitigation.