What is the CVSS score of CVE-2026-13785?

CVE-2026-13785 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by CVE-2026-13785?

All macOS users with Chrome versions prior to 150.0.7871.47 face the risk of silent system compromise through routine web browsing, despite no public exploits currently identified.. A patch is available.

How to fix or mitigate CVE-2026-13785?

Within 24 hours: Audit macOS device inventory to identify Chrome versions below 150.0.7871.47 using MDM or asset management tools. Within 7 days: Deploy Chrome 150.0.7871.47 or later to all macOS endpoints via managed distribution channels. Within 30 days: Verify 100% compliance and enforce minimum version policies to prevent regression.

Google Chrome CVE-2026-13785

EUVD-2026-40471 CRITICAL

Use After Free (CWE-416)

2026-06-30 chrome-cve-admin@google.com

GHSA-r3x8-667c-jhvp

Denial Of Service Google Use After Free Memory Corruption Red Hat Suse

9.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

9.6 CRITICAL

Network-delivered crafted page, no privileges, but mandatory user UI interaction sets UI:R; sandbox escape crosses the process boundary giving S:C with full C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 21:30 vuln.today

CVSS changed

Jul 01, 2026 - 19:22 NVD

9.6 (None) 9.6 (CRITICAL)

CVE Published

Jun 30, 2026 - 23:16 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:16 nvd

CRITICAL 9.6

DescriptionNVD

Use after free in Bluetooth in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

AnalysisAI

Sandbox escape in Google Chrome on macOS before 150.0.7871.47 stems from a use-after-free in the browser's Bluetooth component, letting a remote attacker who lures a user into specific UI gestures on a crafted HTML page corrupt memory and break out of the renderer sandbox. Rated Critical by Chromium and CVSS 9.6, though no public exploit has been identified and EPSS is low (0.22%, 13th percentile). A vendor fix is available and CISA SSVC currently marks exploitation as 'none'.

Technical ContextAI

The flaw is a CWE-416 use-after-free in Chrome's Web Bluetooth implementation, the API that lets web pages communicate with nearby Bluetooth Low Energy devices via JavaScript (navigator.bluetooth). A use-after-free occurs when code continues to reference heap memory that has already been freed - here reachable through Bluetooth object lifecycle handling - allowing an attacker to reclaim that memory with controlled data and influence subsequent execution. Because the reported impact is a sandbox escape, the corrupted object crosses Chrome's process/privilege boundary rather than staying confined to the renderer, which explains the CVSS scope-change (S:C). The affected CPE is cpe:2.3:a:google:chrome, and the issue is documented as macOS-specific in this advisory.

RemediationAI

Vendor-released patch: Chrome 150.0.7871.47 for macOS - upgrade to this version or later via the Chrome Stable channel update (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html) and restart the browser to apply the fix, since Chrome updates only take effect after relaunch. As an interim compensating control until updates roll out, disabling or restricting Web Bluetooth reduces the attack surface: set the enterprise policy DefaultWebBluetoothGuardSetting to 2 (block) or manage it via chrome://settings site permissions, accepting the trade-off that legitimate web-Bluetooth workflows (device pairing pages, hardware key/peripheral apps) will stop working. Standard browser hygiene - avoiding untrusted links and not performing prompted UI gestures on unfamiliar pages - further limits the UI:R trigger. No separate CISA advisory exists as the CVE is not KEV-listed.