What is the CVSS score of CVE-2026-13790?

CVE-2026-13790 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-13790?

Yes, a patch is available for CVE-2026-13790. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-13790

EUVD-2026-40476 MEDIUM

Improper Protection of Physical Side Channels (CWE-1300)

2026-06-30 chrome-cve-admin@google.com

GHSA-28x5-j68m-fxr3

Information Disclosure Google Suse Red Hat

6.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

vuln.today AI

7.4 HIGH

Cross-origin data leakage crosses the same-origin security boundary (S:C); no privileges required and user must only visit the attacker's page.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

7.4 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 21:33 vuln.today

CVSS changed

Jul 01, 2026 - 19:22 NVD

6.5 (None) 6.5 (MEDIUM)

CVE Published

Jun 30, 2026 - 23:16 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:16 cve.org

MEDIUM 6.5

DescriptionCVE.org

Side-channel information leakage in Scroll in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Side-channel information leakage via Chrome's Scroll implementation exposes cross-origin data to remote attackers who can lure a victim to a crafted HTML page. All Chrome versions prior to 150.0.7871.47 are affected; exploitation requires user interaction (visiting the attacker-controlled page) but no authentication. No public exploit identified at time of analysis and EPSS sits at the 11th percentile, though the confidentiality impact is rated High by NVD given the potential to read data from foreign origins.

Technical ContextAI

CWE-1300 (Improper Protection of Physical Side Channels) is applied here in a browser behavioral context: Chrome's Scroll implementation leaks observable differences - likely timing, layout geometry, or scroll-position inference - that allow a page in one origin to deduce content or state from a cross-origin frame or resource. This class of vulnerability exploits the browser's own internal rendering or event-handling subsystem as an unintentional covert channel. The affected component is Google Chrome (Chromium engine) in all releases prior to the 150.0.7871.47 stable channel build, as identified in the Chrome releases advisory and the EUVD entry EUVD-2026-40476. No CPE strings were provided in the source data, but the affected scope is the Chromium browser across desktop platforms.

RemediationAI

Vendor-released patch: Chrome 150.0.7871.47. Update immediately via Chrome's built-in updater (Settings → Help → About Google Chrome) or via enterprise deployment tooling; the advisory is at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. For organizations that cannot immediately update, compensating controls include enforcing Chrome's Site Isolation feature (--site-per-process, enabled by default in modern Chrome) which raises the bar for cross-origin side-channel attacks, and restricting user access to untrusted or unknown web properties via proxy policy. Disabling JavaScript entirely would prevent exploitation but is operationally impractical for most deployments. Enterprise administrators should prioritize patching given Chrome's ubiquitous deployment footprint, even though real-world exploitation signals remain low.