What is the CVSS score of CVE-2026-13027?

CVE-2026-13027 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by CVE-2026-13027?

A heap corruption flaw in Google Chrome (pre-149.0.7827.197) creates remote code execution risk for any employee who visits an attacker-controlled webpage.. A patch is available.

How to fix or mitigate CVE-2026-13027?

Within 24 hours: Assess Chrome deployment scope and activate update mechanism. Within 7 days: Deploy Chrome 149.0.7827.197 or later across all endpoints. Within 30 days: Audit deployment completion and retire unsupported versions from inventory.

Google Chrome CVE-2026-13027

EUVD-2026-39042 HIGH

Use After Free (CWE-416)

2026-06-24 Chrome

GHSA-4mp6-2r26-5pw4

Denial Of Service Google Use After Free Memory Corruption Red Hat

8.8

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Triggered by visiting a malicious page so AV:N/UI:R/PR:N/AC:L; use-after-free can yield renderer code execution giving high C/I/A, scope unchanged within the sandboxed process.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 24, 2026 - 21:32 vuln.today

CVSS changed

Jun 24, 2026 - 20:22 NVD

8.8 (HIGH)

CVE Published

Jun 24, 2026 - 18:43 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 24, 2026 - 18:43 cve.org

HIGH 8.8

DescriptionCVE.org

Use after free in FileSystem in Google Chrome prior to 149.0.7827.197 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Renderer-side heap corruption in Google Chrome's FileSystem component (versions prior to 149.0.7827.197) lets a remote attacker who lures a victim to a crafted HTML page trigger a use-after-free, potentially leading to arbitrary code execution within the renderer. Rated High severity by Chromium with a CVSS of 8.8; no public exploit identified at time of analysis, and CISA's SSVC framework currently records exploitation status as 'none'. EPSS data was not provided, but the user-interaction requirement (visiting a page) is the only meaningful barrier, making this a routine but real browser-patch priority.

Technical ContextAI

The flaw is a CWE-416 use-after-free in Chrome's FileSystem implementation - the Blink/Chromium subsystem that backs the sandboxed FileSystem and storage APIs exposed to web content. A use-after-free occurs when a heap object is freed while a dangling reference to it remains live; subsequent reuse of that freed memory can corrupt the heap, and an attacker who controls the reclaimed allocation can steer execution. Because the trigger is reachable from JavaScript/DOM running on an attacker-controlled page, exploitation happens inside the renderer process. The affected CPE is cpe:2.3:a:google:chrome:*, i.e. the desktop Chrome browser across operating systems built on the Chromium engine (which also underpins Edge, Brave, Opera and other derivatives that may inherit the same defect).

RemediationAI

Vendor-released patch: update Google Chrome to 149.0.7827.197 or later on the Stable channel; on managed fleets, force the browser relaunch so the patched binary is loaded rather than relying on the next user-initiated restart. The authoritative advisory is Google's Stable channel post (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0482630350.html); track Chromium issue 520543781 for technical detail. There is no documented configuration workaround for the underlying memory bug, but until the update is deployed you can reduce exposure by enabling Chrome's 'Enhanced protection' Safe Browsing and the renderer site-isolation defaults (left on), and by restricting browsing to trusted sites via policy - accepting the usability trade-off that these controls slow but do not eliminate exploitation, since the bug triggers purely from rendering a crafted page. Apply the equivalent vendor update to any Chromium-derived browsers in the environment.