What is the CVSS score of CVE-2026-13788?

CVE-2026-13788 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Google Chrome are affected by CVE-2026-13788?

Google Chrome for Android versions prior to 150.0.7871.47 contain a remote code execution vulnerability that could allow attackers to compromise devices when users visit malicious websites,…. A patch is available.

How to fix or mitigate CVE-2026-13788?

Within 24 hours: Audit inventory to identify all Android devices running Chrome versions prior to 150.0.7871.47 and assess which are corporate-managed or access business systems. Within 7 days: Deploy Chrome 150.0.7871.47 or later through your MDM platform and app store updates; communicate mandatory update requirement to all users. Within 30 days: Verify patch deployment compliance across 100% of target devices; flag non-compliant devices for remediation or access restriction.

Google Chrome CVE-2026-13788

EUVD-2026-40474 HIGH

Use After Free (CWE-416)

2026-06-30 chrome-cve-admin@google.com

GHSA-8c3f-97rx-rmcp

RCE Denial Of Service Google Use After Free Memory Corruption Red Hat Suse

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable via a crafted page with no auth (AV:N/PR:N) but gated on the victim loading it (UI:R); memory corruption yields high C/I/A within the unchanged renderer scope.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 17:34 vuln.today

CVSS changed

Jul 01, 2026 - 15:22 NVD

8.8 (HIGH)

CVE Published

Jun 30, 2026 - 23:16 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:16 cve.org

HIGH 8.8

DescriptionCVE.org

Use after free in Fullscreen in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)

AnalysisAI

Remote code execution in Google Chrome for Android before 150.0.7871.47 stems from a use-after-free in the Fullscreen component, letting a remote attacker who lures a victim to a crafted HTML page corrupt memory and run arbitrary code in the renderer. Chromium rates the flaw Critical, though CVSS scores it 8.8 because exploitation requires the victim to open the malicious page. There is no public exploit identified at time of analysis, and the EPSS probability is low (0.26%, 17th percentile), with CISA SSVC showing no known exploitation.

Technical ContextAI

The defect is a CWE-416 use-after-free in Chrome's Fullscreen subsystem, which manages the DOM Fullscreen API used by web content to request full-screen presentation. Use-after-free bugs occur when code retains and dereferences a pointer to heap memory that has already been freed, typically during element teardown, navigation, or state transitions triggered by JavaScript; an attacker can groom the heap so the freed slot is reoccupied with attacker-controlled data, converting the dangling reference into a controlled read/write and ultimately code execution within the sandboxed renderer process. This affects the Chrome browser engine (Blink/Chromium) as shipped on Android; the vendor identifies the impacted product as Google Chrome versions prior to 150.0.7871.47.

RemediationAI

Vendor-released patch: update Google Chrome for Android to 150.0.7871.47 or later via the Chrome Stable channel / Google Play, per the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Because the bug is reached through ordinary web browsing, there is no clean feature-level workaround; interim compensating controls include ensuring Chrome auto-update is enabled so the fix lands promptly, and, in managed fleets, using enterprise policy to enforce a minimum browser version and block un-updated builds. Restricting users to trusted sites via URL allowlisting lowers the odds of encountering a malicious page but materially limits normal browsing and does not eliminate risk from compromised or ad-served content, so upgrading remains the only reliable fix.