What is the CVSS score of CVE-2026-13774?

CVE-2026-13774 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by CVE-2026-13774?

Google Chrome's Extensions component contains a use-after-free vulnerability (CVSS 8.1) enabling arbitrary code execution in desktop versions prior to 150.0.7871.47; no public exploit identified at…. A patch is available.

How to fix or mitigate CVE-2026-13774?

Within 24 hours: Audit current Chrome deployment inventory and review extension governance policies. Within 7 days: Deploy Chrome 150.0.7871.47 or later through your update mechanism (auto-update recommended; expedite for managed deployments). Within 30 days: Verify 100% adoption of patched versions and implement or reinforce allowlist-only extension installation policies.

Google Chrome CVE-2026-13774

EUVD-2026-40460 HIGH

Use After Free (CWE-416)

2026-06-30 chrome-cve-admin@google.com

GHSA-9q5x-c58m-xcp8

RCE Denial Of Service Google Use After Free Memory Corruption Red Hat Suse

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

AC:H for the heap-timing UAF and UI:R because the victim must actively install the malicious extension; PR:N as no prior authentication is needed, with full C/I/A impact from code execution.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

9.0 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 17:36 vuln.today

CVSS changed

Jul 01, 2026 - 15:22 NVD

8.1 (None) 8.1 (HIGH)

CVE Published

Jun 30, 2026 - 23:16 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:16 nvd

HIGH 8.1

DescriptionNVD

Use after free in Extensions in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code via a crafted Chrome Extension. (Chromium security severity: Critical)

AnalysisAI

Arbitrary code execution in Google Chrome desktop versions prior to 150.0.7871.47 stems from a use-after-free flaw in the Extensions component, which Chromium rated Critical severity. An attacker who convinces a victim to install a malicious extension can trigger the dangling-pointer condition through a crafted extension to run arbitrary code in the affected process. There is no public exploit identified at time of analysis, EPSS is low (0.16%, 6th percentile), and CISA/SSVC records no observed exploitation.

Technical ContextAI

The defect is a CWE-416 use-after-free in Chrome's Extensions subsystem, the C++ runtime that loads, sandboxes, and mediates the APIs available to browser extensions. Use-after-free occurs when code continues to reference a heap object after it has been freed; a crafted extension can drive Chrome into freeing an object while a pointer to it remains live, then reallocate that memory with attacker-controlled data to corrupt program state and hijack control flow. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* confirms the affected product is the Chrome browser application itself (all builds below the fixed release), and the Chromium 'Critical' label reflects the memory-corruption-to-code-execution potential typical of Extensions UAF bugs.

RemediationAI

Vendor-released patch: Chrome 150.0.7871.47 - upgrade all desktop Chrome installations to 150.0.7871.47 or later, which for most users occurs automatically; force the update via chrome://settings/help and restart the browser, then confirm the version. In managed environments, push the update through enterprise policy and verify rollout, per the Chrome Releases advisory (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html). As a compensating control until patched, restrict extension installation using the ExtensionInstallBlocklist/ExtensionInstallAllowlist enterprise policies (allowlisting only vetted extensions) so users cannot side-load or install untrusted extensions - the trade-off is reduced user flexibility and added admin overhead in curating the allowlist. Auditing and removing unrecognized already-installed extensions further reduces exposure to the required attack precondition.