What is the CVSS score of CVE-2026-13796?

CVE-2026-13796 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by CVE-2026-13796?

Google Chrome's Chromecast component contains a critical sandbox escape vulnerability (CVE-2026-13796) that allows attackers who have already compromised the browser's renderer process to escalate…. A patch is available.

How to fix or mitigate CVE-2026-13796?

Within 24 hours: Begin deployment of Chrome version 150.0.7871.47 or later; prioritize endpoints with Chromecast connectivity or privileged user accounts. Within 7 days: Complete patching across all Chrome installations via your endpoint management platform and verify deployment completion. Within 30 days: Audit Chrome crash reports and sandbox escape indicators on patched systems to determine if exploitation was attempted before updates were applied.

Google Chrome CVE-2026-13796

EUVD-2026-40482 CRITICAL

External Control of Assumed-Immutable Web Parameter (CWE-472)

2026-06-30 chrome-cve-admin@google.com

GHSA-cvrq-wrmp-54gx

Buffer Overflow Google Red Hat Suse

9.6

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

AC:H because exploitation requires a pre-existing renderer compromise and a crafted page; UI:R for page load; S:C and C/I/A:H reflect full sandbox escape into the browser process.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

8.7 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 18:23 vuln.today

CVSS changed

Jul 01, 2026 - 18:22 NVD

9.6 (CRITICAL)

CVE Published

Jun 30, 2026 - 23:16 cve.org

CRITICAL 9.6

CVE Published

Jun 30, 2026 - 23:16 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Integer overflow in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome's Chromecast component before 150.0.7871.47 lets an attacker who has already compromised the renderer process break out of the sandbox via a crafted HTML page, escalating from renderer-level code execution to the more privileged browser process. Google rates the Chromium severity High and the CVSS is 9.6 due to the scope change; however, EPSS is only 0.21% (11th percentile) and there is no public exploit identified at time of analysis. A vendor patch is available.

Technical ContextAI

The flaw lives in Chrome's Chromecast (media casting/receiver) functionality, which handles media routing and rendering to Cast-enabled devices. The description and vendor labeling identify an integer overflow (tagged 'Buffer Overflow'), a numeric miscalculation class typically tracked as CWE-190; the assigned CWE-472 (External Control of Assumed-Immutable Web Parameter) does not obviously match an integer-overflow root cause and should be treated as a possible mis-tag pending vendor clarification. In Chrome's multi-process architecture, untrusted web content runs in a low-privilege sandboxed renderer; a bug in a component reachable from the renderer that corrupts memory in a higher-privilege context enables a sandbox escape, which is precisely the scenario here (scope change, S:C).

RemediationAI

Vendor-released patch: update Google Chrome to 150.0.7871.47 or later on all desktop platforms; Chrome typically auto-updates, so verify via chrome://settings/help and relaunch to apply. See Google's advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html and the Chromium issue tracker at https://issues.chromium.org/issues/491894115 (access may be restricted). For fleets that cannot patch immediately, compensating controls include disabling media casting via enterprise policy (e.g. the EnableMediaRouter / cast-related policies) to reduce reachability of the Chromecast component - trade-off is loss of Cast functionality for users - and enforcing renderer-hardening/site-isolation defaults plus prompt patching of any renderer RCE bugs, since this escape requires a prior renderer compromise to be useful. Ensure Chromium-based downstream browsers pull the corresponding upstream fix.