What is the CVSS score of CVE-2026-13789?

CVE-2026-13789 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by CVE-2026-13789?

Google Chrome versions prior to 150.0.7871.47 contain a critical sandbox escape vulnerability (CVE-2026-13789) that poses significant risk to all Chrome users in the organization who encounter…. A patch is available.

How to fix or mitigate CVE-2026-13789?

Within 24 hours: Identify all systems running Chrome versions prior to 150.0.7871.47 and develop a prioritized patching schedule. Within 7 days: Deploy Chrome 150.0.7871.47 or later to all affected systems, prioritizing development machines, high-value user workstations, and systems accessing sensitive data. Within 30 days: Verify 100% deployment compliance, document patching completion, and review security event logs for any exploitation attempts.

Google Chrome CVE-2026-13789

EUVD-2026-40475 CRITICAL

Use After Free (CWE-416)

2026-06-30 chrome-cve-admin@google.com

GHSA-63x7-945p-47jj

Denial Of Service Google Use After Free Memory Corruption Red Hat

9.6

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

Requires prior renderer compromise plus a crafted page and user interaction, so AC:H and UI:R; sandbox escape yields scope change (S:C) with total C/I/A impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Red Hat

9.0 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 21:30 vuln.today

CVSS changed

Jul 01, 2026 - 19:22 NVD

9.6 (None) 9.6 (CRITICAL)

CVE Published

Jun 30, 2026 - 23:16 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:16 cve.org

CRITICAL 9.6

DescriptionCVE.org

Use after free in GPU in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome's GPU process (versions prior to 150.0.7871.47) lets a remote attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page. Rated High by Chromium and CVSS 9.6 due to a scope-changing (S:C) full-impact outcome, this is a use-after-free (CWE-416) memory-corruption bug. No public exploit identified at time of analysis; EPSS is low (0.21%, 11th percentile) and CISA SSVC lists exploitation as none, so it is a serious-but-not-yet-exploited patch priority.

Technical ContextAI

The flaw is a use-after-free (CWE-416) in Chrome's GPU process, the component that handles graphics compositing, WebGL, and hardware-accelerated rendering on behalf of the sandboxed renderer via Chromium's IPC/Mojo interfaces. In Chrome's multi-process security model the renderer runs in a tight sandbox and must delegate GPU operations to the more-privileged GPU process; a dangling pointer that is freed and then reused there gives an attacker a primitive to corrupt memory in that higher-privilege context. The EUVD CPE data scopes this to the Chrome 150.x desktop branch before 150.0.7871.47; because Chromium is the upstream engine, the same class of bug typically also affects downstream Chromium browsers (Edge, Brave, Opera, Vivaldi) until they rebase, though only Google Chrome is named here.

RemediationAI

Vendor-released patch: update Google Chrome to 150.0.7871.47 or later on the Stable channel, per the Chrome Releases advisory (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html); Chrome's auto-update normally delivers this, so ensure clients are not blocking updates and force a relaunch to apply it. In managed fleets, push the update via your enterprise policy/management tooling and confirm the running version through chrome://settings/help. If patching must be briefly delayed, the meaningful compensating control is to reduce the renderer-compromise attack surface that this bug depends on: enforce strict site isolation (default), restrict browsing to trusted sites, and consider disabling GPU hardware acceleration (chrome://settings → System, or the --disable-gpu / HardwareAccelerationModeEnabled=false policy) to shrink the vulnerable GPU-process code path - with the trade-off of degraded rendering/WebGL/video performance and higher CPU use. There is no configuration workaround that substitutes for the patch, and users of downstream Chromium browsers should apply their respective vendor's rebased update.