What is the CVSS score of CVE-2026-13787?

CVE-2026-13787 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by CVE-2026-13787?

Google Chrome Remote Desktop on Windows prior to version 150.0.7871.47 contains a remote code execution vulnerability that could allow attackers to compromise systems used for remote access.. A patch is available.

How to fix or mitigate CVE-2026-13787?

Within 24 hours: Deploy Chrome version 150.0.7871.47 or later to all Windows endpoints using Chrome Remote Desktop via your patch management system with priority escalation. Within 7 days: Verify patch deployment across all Chrome instances through endpoint monitoring and audit remote access logs for unauthorized connection attempts. Within 30 days: Confirm 100% rollout completion, including offline and infrequently-used systems, and document patch compliance in your vulnerability management system.

Google Chrome CVE-2026-13787

EUVD-2026-40473 HIGH

Use After Free (CWE-416)

2026-06-30 chrome-cve-admin@google.com

GHSA-v8j9-fq97-r26h

RCE Denial Of Service Google Use After Free Memory Corruption Microsoft Red Hat Suse

8.1

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Remote network-triggered use-after-free needing no auth or interaction (AV:N/PR:N/UI:N) but a hard-to-win memory race (AC:H); RCE yields total C/I/A impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

10.0 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 17:36 vuln.today

CVSS changed

Jul 01, 2026 - 15:22 NVD

8.1 (HIGH)

CVE Published

Jun 30, 2026 - 23:16 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:16 cve.org

HIGH 8.1

DescriptionCVE.org

Use after free in Chromoting in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code via malicious network traffic. (Chromium security severity: Critical)

AnalysisAI

Remote code execution in Google Chrome's Chromoting (Chrome Remote Desktop) component on Windows affects all desktop builds prior to 150.0.7871.47, where a use-after-free (CWE-416) lets a remote attacker corrupt memory via malicious network traffic. Google rates the Chromium severity Critical, and a vendor patch is available, but there is no public exploit identified at time of analysis and EPSS is low at 0.24%. High attack complexity (AC:H) means the memory-corruption race is non-trivial to win reliably, tempering the CVSS 8.1 score.

Technical ContextAI

Chromoting is the internal Chromium codename for the Chrome Remote Desktop subsystem, which brokers remote screen-sharing and input over a network transport. The flaw is a use-after-free (CWE-416): the code frees a heap object but retains and later dereferences a dangling pointer, allowing an attacker who controls the timing/content of network traffic to reclaim the freed allocation with attacker-influenced data and steer execution. The single affected CPE is cpe:2.3:a:google:chrome (all versions before the fix), and because Chromoting runs inside the Chrome renderer/host process, successful exploitation yields code execution in that context on Windows specifically.

RemediationAI

Vendor-released patch: 150.0.7871.47 - update Google Chrome to 150.0.7871.47 or later on Windows via the built-in updater (chrome://settings/help) and relaunch to apply, or push the update through enterprise management. Confirm the fix per the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. If patching cannot be immediate, reduce exposure of the vulnerable component by disabling or uninstalling the Chrome Remote Desktop host/extension and restricting inbound remote-desktop connectivity to Chrome hosts; the trade-off is loss of remote-access functionality for users who rely on it. Because the attack vector is network traffic to the Chromoting component, limiting who can initiate remote-desktop sessions (network ACLs, trusted peers only) lowers risk until the browser is updated.