What is the CVSS score of CVE-2026-13794?

CVE-2026-13794 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Google Chrome are affected by CVE-2026-13794?

Google Chrome for Windows versions prior to 150.0.7871.47 contains a remote code execution vulnerability that could grant attackers unauthorized access to user systems and corporate data through…. A patch is available.

How to fix or mitigate CVE-2026-13794?

Within 24 hours: Deploy Google Chrome 150.0.7871.47 via endpoint management tools to all Windows systems. Within 7 days: Verify patch compliance across the Windows user base and confirm no systems remain on vulnerable versions. Within 30 days: Review security awareness training to reinforce phishing and malicious link recognition; monitor endpoint detection for suspicious Chrome child process activity.

Google Chrome CVE-2026-13794

EUVD-2026-40480 HIGH

Improper Input Validation (CWE-20)

2026-06-30 chrome-cve-admin@google.com

GHSA-f556-8c4p-xcw9

RCE Google Microsoft Red Hat Suse

7.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Remote crafted page (AV:N, PR:N) but needs specific victim UI gestures and non-trivial conditions (UI:R, AC:H); RCE yields full C/I/A impact within the browser (S:U).

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 15:23 vuln.today

CVSS changed

Jul 01, 2026 - 15:22 NVD

7.5 (HIGH)

CVE Published

Jun 30, 2026 - 23:16 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:16 cve.org

HIGH 7.5

DescriptionCVE.org

Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome on Windows before version 150.0.7871.47 allows an attacker to run arbitrary code by luring a victim to a crafted HTML page and getting them to perform specific UI gestures against the WebAppInstalls component. Chromium rates the flaw High severity; no public exploit identified at time of analysis, and the EPSS probability is low (0.26%, 17th percentile), indicating the attack is not yet broadly commoditized despite the serious impact.

Technical ContextAI

The defect lives in Chrome's WebAppInstalls subsystem, the browser machinery that handles Progressive Web App / web app installation flows on Windows. Per CWE-20 (Improper Input Validation), the root cause is insufficient validation of untrusted input reaching this component from web content, which lets a malicious page steer the install-related UI/logic into an unsafe state that ultimately yields code execution in the browser process. Because the trigger is a crafted HTML page combined with user-driven UI gestures, the untrusted input crosses the renderer/browser boundary through the install workflow rather than through a memory-corruption parser bug alone. The affected code is Windows-specific to this CVE, and the fix ships in the Chromium stable channel at 150.0.7871.47.

RemediationAI

Vendor-released patch: upgrade Google Chrome on Windows to 150.0.7871.47 or later via the Chrome Releases stable-channel update (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html); most environments should confirm auto-update completed and relaunch the browser to apply the fix, since Chrome updates only take effect after restart. Enterprises managing Chrome via policy should push the updated version and verify the reported build across the fleet. Until the update is deployed, reduce exposure by user-awareness guidance to avoid unfamiliar sites prompting for install/UI gestures and, where PWA installation is not needed, disable web app installation via the WebAppInstallForceList/BlockExternalExtensions-style management policies - the trade-off is loss of PWA install functionality for users who rely on it. No standalone workaround is a substitute for the patch, which is the primary and recommended remediation.