What is the CVSS score of CVE-2026-13036?

CVE-2026-13036 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by CVE-2026-13036?

A remote code execution vulnerability in Google Chrome (CVE-2026-13036, CVSS 8.8) allows attackers to execute arbitrary code on systems running versions prior to 149.0.7827.197 through malicious web…. A patch is available.

How to fix or mitigate CVE-2026-13036?

24 hours: Issue urgent directive requiring all users to update Google Chrome to version 149.0.7827.197 or later and verify automatic updates are enabled. 7 days: Confirm 100% patch deployment through endpoint management tools and conduct verification audits. 30 days: Complete remediation validation and document patching campaign results.

Google Chrome CVE-2026-13036

EUVD-2026-39048 HIGH

Use After Free (CWE-416)

2026-06-24 Chrome

RCE Denial Of Service Google Use After Free Memory Corruption Red Hat

8.8

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Remote crafted page with no auth (AV:N/PR:N) but requires the victim to open it (UI:R); high memory-corruption impact within the unchanged renderer sandbox scope (S:U).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 24, 2026 - 21:34 vuln.today

CVSS changed

Jun 24, 2026 - 20:22 NVD

8.8 (HIGH)

CVE Published

Jun 24, 2026 - 18:43 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 24, 2026 - 18:43 cve.org

HIGH 8.8

DescriptionCVE.org

Use after free in Blink in Google Chrome prior to 149.0.7827.197 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome's Blink rendering engine (versions prior to 149.0.7827.197) allows a remote attacker to run arbitrary code within the renderer sandbox by luring a victim to a crafted HTML page. The flaw is a use-after-free (CWE-416) rated High by Chromium with a CVSS of 8.8; it requires user interaction (visiting a malicious page) but no authentication. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, with the CISA SSVC framework recording exploitation status as none.

Technical ContextAI

Blink is the open-source rendering engine used by Chromium-based browsers (Chrome, and downstream Edge, Brave, Opera, Electron apps) to parse and render HTML, CSS, and the DOM. The root cause is a use-after-free (CWE-416): a memory object is freed while a dangling pointer still references it, and subsequent access to that stale pointer lets an attacker manipulate freed heap memory. In a renderer like Blink, attacker-controlled JavaScript/HTML can groom the heap to reoccupy the freed allocation with controlled data, converting the dangling reference into a controlled read/write primitive and ultimately code execution. Per the CPE (cpe:2.3:a:google:chrome) the affected component is the Chrome browser application itself; the description scopes the resulting code execution to inside the sandbox rather than a full host compromise.

RemediationAI

Vendor-released patch: 149.0.7827.197 - update Google Chrome to 149.0.7827.197 or later via the Chrome Releases stable channel update (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0482630350.html), then fully relaunch the browser to apply the new build since Chrome only loads the updated binary after a restart. Users of Chromium-based browsers (Edge, Brave, Opera) should apply the equivalent vendor update once it ships the corresponding Blink fix. As an interim compensating control before patching, restrict exposure by avoiding untrusted links and enabling site isolation (default in Chrome), and where feasible deploy enterprise policies to enforce auto-update; note that disabling JavaScript would reduce the renderer attack surface but breaks the modern web and is generally impractical. The Chromium issue tracker reference is https://issues.chromium.org/issues/523711130 (details may remain restricted until broad patch uptake).