What is the CVSS score of CVE-2026-13033?

CVE-2026-13033 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by CVE-2026-13033?

Google Chrome (all desktop versions prior to 149.0.7827.197) contains a remote code execution vulnerability in the Blink rendering engine that allows attackers to execute arbitrary code on employee…. A patch is available.

How to fix or mitigate CVE-2026-13033?

Within 24 hours: Deploy Chrome version 149.0.7827.197 or later to all endpoints via your software distribution system (WSUS, Intune, Jamf, or equivalent). Within 7 days: Verify 100% of enterprise Chrome installations are running version 149.0.7827.197+ through your endpoint management tools. Within 30 days: Query endpoint logs for exploitation indicators including abnormal renderer process behavior, memory access violations, or unexpected child processes spawned from Chrome.

Google Chrome CVE-2026-13033

EUVD-2026-39034 HIGH

Out-of-bounds Read (CWE-125)

2026-06-24 Chrome

RCE Buffer Overflow Information Disclosure Google Red Hat

8.8

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Remote crafted page (AV:N), no privileges (PR:N) but requires visiting the page (UI:R); renderer-only RCE keeps scope unchanged (S:U) with full C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Red Hat

8.8 CRITICAL

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 24, 2026 - 21:31 vuln.today

CVSS changed

Jun 24, 2026 - 20:22 NVD

8.8 (HIGH)

CVE Published

Jun 24, 2026 - 18:43 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 24, 2026 - 18:43 cve.org

HIGH 8.8

DescriptionCVE.org

Out of bounds read and write in Blink>InterestGroups in Google Chrome prior to 149.0.7827.197 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)

AnalysisAI

Remote code execution in Google Chrome's Blink rendering engine (InterestGroups component, part of the Privacy Sandbox/Protected Audience ad-auction API) affects all desktop versions prior to 149.0.7827.197. A crafted HTML page triggers an out-of-bounds read and write that a remote attacker can leverage to execute arbitrary code in the renderer; Chromium rates this Critical and assigns CVSS 8.8. There is no public exploit identified at time of analysis, but a vendor patch is already available, making prompt updating the priority.

Technical ContextAI

The flaw lives in Blink, Chromium's rendering engine, specifically the InterestGroups implementation that backs the Protected Audience / FLEDGE Privacy Sandbox API used for on-device advertising auctions. The root cause is CWE-125 (Out-of-bounds Read), compounded here by an accompanying out-of-bounds write per the description, indicating a memory-safety defect where attacker-influenced data lets the engine read and write beyond an allocated buffer. Because Blink parses and processes untrusted web content directly, a malformed page that exercises the InterestGroups code path can corrupt renderer-process memory. The affected product per CPE is cpe:2.3:a:google:chrome (all versions before the fixed build), and the same code is shared across Chromium-based browsers (Edge, Brave, Opera, Vivaldi), which typically require their own downstream updates.

RemediationAI

Vendor-released patch: update Google Chrome to 149.0.7827.197 or later via the Stable channel; on most installs this is automatic after relaunch, so the actionable step is to force-update through chrome://settings/help and restart the browser to apply it. Verify deployment across managed fleets via enterprise update policies and confirm the version string post-relaunch. Users of other Chromium-based browsers should apply the equivalent vendor update once published. As an interim compensating control before patching, the InterestGroups attack surface is the Privacy Sandbox / Protected Audience ad-auction feature, which can be disabled via the Ad privacy settings (chrome://settings/adPrivacy) or enterprise policy - the trade-off is loss of Privacy Sandbox functionality but reduced exposure to this specific code path; note this is not a vendor-validated mitigation and does not substitute for the patch. Refer to the official advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0482630350.html.