What is the CVSS score of CVE-2026-13781?

CVE-2026-13781 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by CVE-2026-13781?

Google Chrome contains a critical sandbox escape vulnerability (CVE-2026-13781, CVSS 9.6) in the Skia graphics engine affecting versions prior to 150.0.7871.47.. A patch is available.

How to fix or mitigate CVE-2026-13781?

Within 24 hours: inventory all Chrome deployments across the organization and identify instances running pre-150.0.7871.47 versions. Within 7 days: deploy Chrome version 150.0.7871.47 or later to all endpoints, with priority given to systems handling sensitive data or with elevated-privilege users. Within 30 days: verify patch deployment completion organization-wide and confirm all instances have been updated or are uninstalled.

Google Chrome CVE-2026-13781

EUVD-2026-40467 CRITICAL

Improper Input Validation (CWE-20)

2026-06-30 chrome-cve-admin@google.com

GHSA-q267-54c8-8vcg

Information Disclosure Google Red Hat Suse

9.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

7.6 HIGH

Requires a pre-compromised renderer (PR:H) and chaining plus user interaction (AC:H, UI:R); successful escape crosses the sandbox boundary (S:C) with total impact.

3.1 AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

9.0 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 19:15 vuln.today

CVSS changed

Jul 01, 2026 - 17:07 NVD

9.6 (CRITICAL)

CVE Published

Jun 30, 2026 - 23:16 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:16 nvd

CRITICAL 9.6

DescriptionNVD

Insufficient validation of untrusted input in Skia in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

AnalysisAI

Sandbox escape in Google Chrome's Skia graphics engine (versions prior to 150.0.7871.47) lets an attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page, achieving high-impact code execution across the security boundary (scope change). Rated Critical by Chromium and CVSS 9.6, but no public exploit is identified at time of analysis and EPSS is low (0.22%, 13th percentile). SSVC lists exploitation status as none, indicating no observed active exploitation.

Technical ContextAI

Skia is the open-source 2D graphics rendering library used by Chrome (and Chromium-derived browsers, Android, Flutter) to rasterize web content, canvas, and GPU-accelerated drawing. The root cause is classified as CWE-20 (Improper Input Validation): Skia insufficiently validates untrusted geometry/drawing input supplied through a crafted HTML page, and because parts of the graphics pipeline execute at a higher privilege than the sandboxed renderer, malformed input can be leveraged to cross the sandbox boundary. The CPE cpe:2.3:a:google:chrome:*:* confirms the affected product is the Chrome application; Skia is the internal component, not a separately versioned product here.

RemediationAI

Vendor-released patch: update Google Chrome to 150.0.7871.47 or later per the Chrome Stable channel advisory (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html); Chrome normally auto-updates, so verify via chrome://settings/help and relaunch to apply the fix, and push the update through your enterprise management (GPO/MDM/admx) to ensure fleet-wide deployment. Users of other Chromium-based browsers should apply their vendor's corresponding update once it ships the Skia fix. If patching must be delayed, reduce exposure to the prerequisite renderer compromise by enabling Chrome's site isolation (default) and restricting untrusted browsing, since the sandbox escape only matters after a renderer is already compromised; note these are stopgaps that do not remediate the underlying Skia validation flaw. The Chromium issue tracker entry (https://issues.chromium.org/issues/516457532) may remain access-restricted until broad patch adoption.