What is the CVSS score of CVE-2026-13281?

CVE-2026-13281 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by CVE-2026-13281?

Google Chrome versions before 149.0.7827.201 contain a sandbox escape vulnerability (CVE-2026-13281, CVSS 8.3) that allows attackers with renderer process access to escalate to system-level…. A patch is available.

How to fix or mitigate CVE-2026-13281?

Within 24 hours, inventory all Chrome installations across Windows, macOS, and Linux endpoints to identify current versions and assess exposure. Within 7 days, deploy Chrome version 149.0.7827.201 or later through your standard update mechanism (manual, auto-update, or MDM); prioritize endpoints in high-security roles and external-facing environments. Within 30 days, complete rollout to 100% of Chrome installations and verify via endpoint telemetry that no versions below 149.0.7827.201 remain in active use.

Google Chrome CVE-2026-13281

EUVD-2026-39583 HIGH

External Control of Assumed-Immutable Web Parameter (CWE-472)

2026-06-25 Chrome

GHSA-77fq-rmxj-265c

Buffer Overflow Google

8.3

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

Kept AC:H and UI:R for the hard-to-hit, file-delivered overflow and PR:N/S:C because the sandbox escape crosses a privilege boundary, with total C/I/A on successful browser-process compromise.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

HIGH

qualitative

Red Hat

8.7 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 20:14 vuln.today

CVE Published

Jun 25, 2026 - 21:51 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 25, 2026 - 21:51 cve.org

HIGH 8.3

DescriptionCVE.org

Integer overflow in Mojo in Google Chrome prior to 149.0.7827.201 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a malicious file. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome desktop before 149.0.7827.201 lets an attacker who has already compromised the renderer process break out of the sandbox by supplying a malicious file that triggers an integer overflow in the Mojo IPC layer. Chrome rated this High severity; it is fixed in the June 2026 Stable channel. No public exploit is identified at time of analysis, EPSS is low (0.18%), and CISA SSVC records no observed exploitation.

Technical ContextAI

Mojo is Chromium's inter-process communication (IPC) system that brokers messages between the low-privilege renderer processes and the higher-privilege browser process, and is the primary boundary an attacker must cross to escape the Chrome sandbox. An integer overflow in Mojo's message/handle handling can cause an incorrect size or index calculation, leading to out-of-bounds access or memory corruption that undermines the trust the browser process places in renderer-supplied data. The CVE is tagged CWE-472 (External Control of Assumed-Immutable Web Parameter), though the description and 'Buffer Overflow' tag point to a classic integer-overflow-to-memory-corruption pattern; the CPE cpe:2.3:a:google:chrome confirms the desktop Chrome application as the affected component.

RemediationAI

Vendor-released patch: update Google Chrome to 149.0.7827.201 or later on all desktop platforms via the Stable channel; most installations receive this automatically, but administrators should force the update and confirm via chrome://settings/help, since the fix is memory-corruption in a privilege boundary and has no in-product workaround. For managed fleets, push the update through enterprise policy and restart browsers to apply it. Chromium-based and Linux-distributed builds should track their vendor's rebuild (see the SUSE/Red Hat channels) and apply the corresponding package update. Reference the Chrome release advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_01245939337.html. As a compensating control until patched, reduce the renderer-compromise prerequisite by disabling or restricting untrusted content - enable Enhanced Safe Browsing and site isolation (default) and avoid opening untrusted files/pages - accepting that this only lowers, not eliminates, the chance an attacker reaches the vulnerable Mojo path.