What is the CVSS score of CVE-2026-13034?

CVE-2026-13034 has a CVSS 3.1 base score of 4.7 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-13034?

Yes, a patch is available for CVE-2026-13034. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-13034

EUVD-2026-39046 MEDIUM

Origin Validation Error (CWE-346)

2026-06-24 Chrome

GHSA-3pfj-fj4c-9hh9

Authentication Bypass Google Red Hat

4.7

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

4.7 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

vuln.today AI

3.4 LOW

AC:H reflects the mandatory renderer compromise prerequisite; AV:N and UI:R align with crafted HTML delivery; S:C and C:L capture limited cross-origin data exposure with no integrity or availability impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 24, 2026 - 21:41 vuln.today

CVSS changed

Jun 24, 2026 - 20:22 NVD

4.7 (MEDIUM)

CVE Published

Jun 24, 2026 - 18:43 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 24, 2026 - 18:43 cve.org

MEDIUM 4.7

DescriptionCVE.org

Inappropriate implementation in Passwords in Google Chrome prior to 149.0.7827.197 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Site isolation bypass in Google Chrome's Passwords implementation allows a remote attacker who has already compromised the renderer process to cross origin boundaries via a crafted HTML page. Affected versions are all Chrome releases prior to 149.0.7827.197 on desktop platforms. Google has confirmed this as a High severity Chromium issue; no public exploit code or active exploitation has been identified at time of analysis, and CISA SSVC categorizes exploitation status as none.

Technical ContextAI

Chrome's site isolation architecture partitions web content into per-origin renderer processes to prevent cross-site data leakage. The Passwords component contains an inappropriate implementation classified under CWE-346 (Origin Validation Error), meaning the software fails to properly validate the origin of requests or data within that subsystem. When a renderer process is already under attacker control, this flaw can be leveraged to break the isolation boundary and gain access to cross-origin password-related data. The affected product is identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* for all desktop Chrome versions prior to 149.0.7827.197. The CVSS scope change metric (S:C) confirms the vulnerability's ability to impact resources outside the compromised rendering context.

RemediationAI

Update Google Chrome to version 149.0.7827.197 or later, which is confirmed as the vendor-released patch per the stable channel update advisory at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0482630350.html. Chrome's auto-update mechanism should deliver this version automatically; administrators managing enterprise fleets should verify deployment via Chrome Browser Cloud Management or policy tooling. As a compensating control where immediate patching is not possible, consider disabling or restricting the Chrome password manager (chrome://settings/passwords) via enterprise policy (PasswordManagerEnabled=false), which removes the vulnerable component from the attack surface at the cost of built-in credential autofill functionality. Additionally, enforcing strict process isolation policies and disabling JavaScript in high-risk browsing contexts limits the attacker's ability to achieve the prerequisite renderer compromise in the first place.