What is the CVSS score of CVE-2026-13780?

CVE-2026-13780 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by CVE-2026-13780?

Google Chrome versions before 150.0.7871.47 contain a critical sandbox escape in the ANGLE graphics component that could allow attackers to escalate privileges from a compromised browser process to…. A patch is available.

How to fix or mitigate CVE-2026-13780?

Within 24 hours: Verify Chrome version distribution across the organization and confirm patch availability. Within 7 days: Deploy Chrome 150.0.7871.47 or later to all affected systems via managed update channels or enterprise distribution tools. Within 30 days: Validate 100% patch deployment through version reporting and document remediation for compliance records.

Google Chrome CVE-2026-13780

EUVD-2026-40466 CRITICAL

Improper Input Validation (CWE-20)

2026-06-30 chrome-cve-admin@google.com

GHSA-7942-58pv-3pg3

Information Disclosure Google Red Hat Suse

9.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.0 HIGH

AC:H and PR:L because exploitation requires a pre-existing renderer compromise (a non-trivial prior foothold), UI:R for page visit, S:C and C/I/A:H for full sandbox escape.

3.1 AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 19:15 vuln.today

CVSS changed

Jul 01, 2026 - 17:07 NVD

9.6 (CRITICAL)

CVE Published

Jun 30, 2026 - 23:16 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:16 nvd

CRITICAL 9.6

DescriptionNVD

Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

AnalysisAI

Sandbox escape in Google Chrome's ANGLE graphics component before version 150.0.7871.47 allows an attacker who has already compromised the renderer process to break out of the browser sandbox and execute code in a higher-privilege context via a crafted HTML page. Google rates the Chromium security severity as Critical (CVSS 9.6), though this is a second-stage bug requiring a prior renderer compromise. A vendor patch is available; no public exploit has been identified at time of analysis and EPSS exploitation probability is low (0.22%).

Technical ContextAI

ANGLE (Almost Native Graphics Layer Engine) is Chrome's graphics abstraction layer that translates OpenGL ES / WebGL calls to the platform's native GPU API (Direct3D, Metal, Vulkan, or desktop GL). It runs across the GPU process and renderer boundary and is a recurring source of sandbox-escape bugs because it processes untrusted, web-controlled graphics commands. The root cause is classified as CWE-20 (Improper Input Validation): ANGLE insufficiently validates untrusted input passed from the compromised renderer, letting a malicious rendering command sequence corrupt state or reach memory it should not, enabling escape of the renderer sandbox. The affected CPE is cpe:2.3:a:google:chrome:*, i.e. the Chrome desktop application on all platforms prior to the fixed build.

RemediationAI

Vendor-released patch: update Google Chrome to 150.0.7871.47 or later via the stable channel; Chrome normally auto-updates, so verify the version under chrome://settings/help and relaunch to apply, as many enterprises delay restarts. Users of other Chromium-based browsers should install the vendor build that incorporates the corresponding ANGLE fix once released. There is no clean feature-level workaround because ANGLE underpins all WebGL/GPU rendering, but as a temporary compensating control you can reduce exposure by disabling GPU acceleration / WebGL (chrome://settings, 'Use graphics acceleration when available' off, or the --disable-gpu / --disable-webgl flags) - this shrinks the ANGLE attack surface at the cost of degraded graphics performance and broken WebGL sites, and it does not fully eliminate ANGLE code paths. Refer to the Chrome Releases advisory (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html) for the definitive fixed build.