What is the CVSS score of CVE-2026-13026?

CVE-2026-13026 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by CVE-2026-13026?

Google Chrome on macOS is vulnerable to remote code execution attacks (CVE-2026-13026, CVSS 8.8) that could compromise endpoints when users visit malicious websites.. A patch is available.

How to fix or mitigate CVE-2026-13026?

24 hours: Inventory all macOS systems running Chrome versions prior to 149.0.7827.197 and segregate highest-risk users if necessary. 7 days: Push Chrome 149.0.7827.197 or later to all affected macOS endpoints via your mobile device management or software deployment platform. 30 days: Run post-deployment scans to confirm 100% remediation and document completion.

Google Chrome CVE-2026-13026

EUVD-2026-39041 HIGH

Use After Free (CWE-416)

2026-06-24 Chrome

GHSA-mmm9-39xr-fcc3

Denial Of Service Google Use After Free Memory Corruption Red Hat

8.8

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Remote crafted page (AV:N) needs only a victim visit (UI:R) with no auth (PR:N); a UAF enabling code execution yields high C/I/A within the unchanged browser scope.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 24, 2026 - 21:32 vuln.today

CVSS changed

Jun 24, 2026 - 20:22 NVD

8.8 (HIGH)

CVE Published

Jun 24, 2026 - 18:43 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 24, 2026 - 18:43 cve.org

HIGH 8.8

DescriptionCVE.org

Use after free in Digital Credentials in Google Chrome on Mac prior to 149.0.7827.197 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Heap corruption via use-after-free in Google Chrome's Digital Credentials component on macOS allows a remote attacker to potentially execute code by luring a victim to a crafted HTML page, affecting Chrome builds prior to 149.0.7827.197. The flaw was reported internally by Google's Chrome team, and per CISA's SSVC framework exploitation is currently 'none', so this is no public exploit identified at time of analysis despite a high (8.8) CVSS score requiring user interaction. EPSS data was not provided, but the absence of KEV listing and no observed exploitation point to risk driven by Chrome's massive install base rather than confirmed in-the-wild abuse.

Technical ContextAI

The root cause is CWE-416 (Use After Free): the Digital Credentials feature - Chrome's implementation of the W3C Digital Credentials API used to request and present verifiable identity/credential documents to web pages - frees a heap object while a dangling reference to it remains, allowing later reuse of freed memory and consequent heap corruption. The affected CPE is cpe:2.3:a:google:chrome (the Chromium-based browser engine), with this specific issue manifesting on the Mac platform per the description. Successful manipulation of the freed allocation can let an attacker control object contents and pivot toward arbitrary code execution within the renderer or related process, which is the classic memory-safety failure mode in browser engines.

RemediationAI

Vendor-released patch: Google Chrome 149.0.7827.197 - update Chrome to 149.0.7827.197 or later on macOS via Chrome's built-in updater (chrome://settings/help) and relaunch to apply, per the Stable channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0482630350.html. In managed fleets, push the updated build through MDM/enterprise policy and force a relaunch to ensure the fix takes effect. If immediate patching is not possible, a meaningful compensating control is to disable or restrict the Digital Credentials feature where exposed (e.g., via enterprise policy or the corresponding chrome://flags entry) to remove the vulnerable attack surface - trade-off: sites relying on the Digital Credentials API will stop functioning. Browsing-hygiene controls (avoiding untrusted pages, enabling Enhanced Safe Browsing) reduce exposure to crafted-page delivery but do not remove the underlying flaw and should not substitute for the update.