What is the CVSS score of CVE-2026-13777?

CVE-2026-13777 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome (iOS) are affected by CVE-2026-13777?

Google Chrome for iOS contains a heap corruption vulnerability (CVSS 8.8) that allows remote attackers to corrupt memory and potentially steal data or compromise devices when users visit malicious…. A patch is available.

How to fix or mitigate CVE-2026-13777?

Within 24 hours: Identify number of iOS devices running Chrome in your environment and assess user access to sensitive data. Within 7 days: Deploy Chrome version 150.0.7871.47 or later to all iOS devices via mobile device management (MDM) or app store update notifications; prioritize corporate-owned devices. Within 30 days: Verify 100% patch compliance; configure MDM policy to enforce automatic Chrome updates on iOS.

Google Chrome (iOS) CVE-2026-13777

EUVD-2026-40463 HIGH

Improper Input Validation (CWE-20)

2026-06-30 chrome-cve-admin@google.com

GHSA-fp9g-w2pv-q2hw

Information Disclosure Google Apple Red Hat Suse

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Remote crafted-page delivery with no auth (AV:N/PR:N) but victim must open the page (UI:R); heap corruption yields high C/I/A within the unchanged browser scope.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 19:32 vuln.today

CVSS changed

Jul 01, 2026 - 17:22 NVD

8.8 (HIGH)

CVE Published

Jun 30, 2026 - 23:16 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:16 nvd

HIGH 8.8

DescriptionNVD

Insufficient validation of untrusted input in iOSWeb in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)

AnalysisAI

Heap corruption in the iOSWeb component of Google Chrome for iOS before 150.0.7871.47 lets a remote attacker who lures a victim to a crafted HTML page potentially achieve memory corruption with high confidentiality, integrity, and availability impact. Chromium rated the underlying issue Critical severity, though the CVSS base score is 8.8 because exploitation requires user interaction (visiting a page). There is no public exploit identified at time of analysis, it is not on CISA KEV, and the EPSS probability is low at 0.21%.

Technical ContextAI

The flaw resides in iOSWeb, the iOS-specific web layer used by Google Chrome on Apple devices, and stems from CWE-20 (Improper Input Validation): untrusted content from a web page is insufficiently validated before use, leading to heap corruption. Because Apple mandates that all iOS browsers use the WebKit engine, Chrome's iOS build differs from its desktop Blink/V8 stack, and iOSWeb is the bridging/rendering integration layer where this validation failure occurs. The affected CPE is cpe:2.3:a:google:chrome:*, and heap corruption of this class can, when combined with additional primitives, be leveraged toward memory disclosure or code execution within the browser's sandboxed process.

RemediationAI

Vendor-released patch: update Google Chrome on iOS to 150.0.7871.47 or later, distributed via the Apple App Store; verify the advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Because Chrome on iOS auto-updates through the App Store, ensure automatic app updates are enabled on managed devices or push the update through MDM to guarantee coverage. There is no vendor-documented configuration workaround for this heap corruption issue; as an interim compensating control until the update propagates, advise users to avoid untrusted links and consider temporarily using an alternative patched browser or Safari, with the trade-off of workflow disruption and loss of Chrome-specific sync/features. Restricting web access to trusted sites via existing web filtering also reduces exposure but does not eliminate the risk from any malicious or compromised page.