What is the CVSS score of CVE-2026-13791?

CVE-2026-13791 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by CVE-2026-13791?

Google Chrome before version 150.0.7871.47 contains a code execution vulnerability in the Downloads component that allows arbitrary code execution through specially crafted malicious extensions.. A patch is available.

How to fix or mitigate CVE-2026-13791?

Within 24 hours: Inventory current Chrome versions across all endpoints and identify users on versions before 150.0.7871.47. Within 7 days: Deploy Chrome 150.0.7871.47 or later via enterprise deployment channels (Windows Update, MDM, or manual distribution). Within 30 days: Verify 100% deployment completion, enforce extension approval policies to restrict unauthorized extension installation, and enable Chrome's safe browsing protections.

Google Chrome CVE-2026-13791

EUVD-2026-40477 HIGH

Improper Input Validation (CWE-20)

2026-06-30 chrome-cve-admin@google.com

GHSA-8qww-3jh8-g7v3

RCE Google Red Hat Suse

8.1

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Description requires the victim to install a malicious extension, so UI:R and AC:H; no auth needed (PR:N) and full RCE gives C/I/A:H.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

7.8 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 15:23 vuln.today

CVSS changed

Jul 01, 2026 - 15:22 NVD

8.1 (HIGH)

CVE Published

Jun 30, 2026 - 23:16 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:16 cve.org

HIGH 8.1

DescriptionCVE.org

Insufficient validation of untrusted input in Downloads in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code via a crafted Chrome Extension. (Chromium security severity: High)

AnalysisAI

Arbitrary code execution in Google Chrome desktop before 150.0.7871.47 arises from insufficient input validation in the Downloads component, letting a crafted Chrome extension break out of its intended sandbox constraints. An attacker who first convinces a victim to install a malicious extension can leverage the flaw to run arbitrary code, which Chromium rates High severity. No public exploit has been identified at time of analysis and EPSS is low (0.15%, 5th percentile), indicating no observed widespread exploitation.

Technical ContextAI

The issue lives in Chrome's Downloads subsystem, which handles file save operations, download metadata, and the extension APIs (chrome.downloads) that permit extensions to initiate and manage downloads. CWE-20 (Improper Input Validation) is the root cause class: data supplied through the extension-facing download path is not sufficiently validated before use, allowing a specially crafted extension to drive the component into an unsafe state that yields code execution. Per the EUVD/NVD CPE and vendor data, the affected surface is the Chrome desktop browser engine (Chromium-based) at versions below 150.0.7871.47; because the same rendering/download stack underlies Chromium, downstream Chromium-based browsers may share the defect until they rebase.

RemediationAI

Vendor-released patch: update Google Chrome to 150.0.7871.47 or later on all desktop platforms; Chrome's built-in auto-update normally delivers this, so trigger a manual update via chrome://settings/help and relaunch to confirm the version, following the Stable channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Because exploitation depends on a malicious extension being installed, the most effective compensating control until patching is to restrict extension installation using enterprise policy (ExtensionInstallBlocklist set to '*' with an explicit ExtensionInstallAllowlist, or ExtensionInstallForcelist for only vetted extensions), which prevents users from adding unvetted extensions at the cost of blocking legitimate self-service extension use. Also audit currently installed extensions and remove any that are unnecessary or unverified; there is no need to disable the Downloads feature itself, and doing so is not a supported control.