What is the CVSS score of CVE-2026-13776?

CVE-2026-13776 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by CVE-2026-13776?

Google Chrome desktop versions prior to 150.0.7871.47 contain a critical sandbox escape in the Dawn WebGPU engine that could permit attackers to escalate privileges and access sensitive user data…. A patch is available.

How to fix or mitigate CVE-2026-13776?

Within 24 hours: Inventory Chrome desktop deployments across the organization and assess user count. Within 7 days: Deploy Chrome 150.0.7871.47 or later via mobile device management or enterprise group policy, enforcing auto-update where possible. Within 30 days: Audit all endpoints to confirm 100% compliance with the patched version and close this vulnerability in your remediation tracking system.

Google Chrome CVE-2026-13776

EUVD-2026-40462 CRITICAL

Access of Resource Using Incompatible Type (Type Confusion) (CWE-843)

2026-06-30 chrome-cve-admin@google.com

GHSA-898f-rrwc-rgmx

Information Disclosure Google Memory Corruption Red Hat Suse

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.0 HIGH

Requires a pre-compromised renderer (PR:L) and victim loading crafted content (UI:R, AC:H); success crosses the sandbox boundary (S:C) with full host-process impact.

3.1 AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

9.0 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 16:01 vuln.today

CVSS changed

Jul 01, 2026 - 15:52 NVD

9.8 (CRITICAL)

CVE Published

Jun 30, 2026 - 23:16 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:16 nvd

CRITICAL 9.8

DescriptionNVD

Type Confusion in Dawn in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

AnalysisAI

Sandbox escape via type confusion in Google Chrome's Dawn WebGPU implementation allows an attacker who already controls a compromised renderer process to break out of the browser sandbox using a crafted HTML page, affecting all Chrome desktop builds prior to 150.0.7871.47. Rated Critical by Chromium and CVSS 9.8, though the score assumes no prior privilege; realistically it is the second stage of an exploit chain. A vendor patch is available and no public exploit has been identified at time of analysis (EPSS 0.24%, 15th percentile).

Technical ContextAI

Dawn is Chromium's open-source implementation of the WebGPU standard, providing web pages with lower-level access to GPU hardware for rendering and compute. It runs partly in the GPU/renderer boundary and processes attacker-influenced graphics command streams. The root cause is CWE-843 (Type Confusion): code interprets a memory object as one type when it is actually another, allowing out-of-bounds or type-inconsistent memory operations. In the context of Dawn, malformed WebGPU calls from a compromised renderer can coerce the GPU-side code into mishandling object types, yielding memory corruption primitives that can be leveraged to escape the sandbox. The single affected CPE is cpe:2.3:a:google:chrome, i.e. the Chrome desktop application itself.

RemediationAI

Update to Google Chrome 150.0.7871.47 or later on all desktop platforms - Vendor-released patch: 150.0.7871.47, per the Chrome Stable channel advisory (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html). Because Chrome auto-updates, ensure clients actually restart to apply the update and confirm the running version via chrome://settings/help; in managed fleets push the update through your endpoint/patch management to close the window quickly. As an interim compensating control before patching, WebGPU can be disabled to remove the vulnerable Dawn attack surface - for example via enterprise policy or by disabling the relevant chrome://flags/#enable-unsafe-webgpu and WebGPU features - which blocks this vector at the cost of breaking pages that legitimately rely on GPU compute/rendering. General renderer-hardening (site isolation, restricting untrusted browsing) reduces but does not eliminate risk since this bug is triggered from an already-compromised renderer.