What is the CVSS score of CVE-2026-13797?

CVE-2026-13797 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by CVE-2026-13797?

Google Chrome's Chromecast component contains a critical sandbox escape vulnerability (CVE-2026-13797) affecting versions prior to 150.0.7871.47 that could enable full system compromise if chained…. A patch is available.

How to fix or mitigate CVE-2026-13797?

Within 24 hours, inventory all Chrome installations and identify systems running versions prior to 150.0.7871.47, prioritizing Chromecast users and systems processing untrusted content. Within 7 days, deploy Chrome version 150.0.7871.47 or later to all affected systems, beginning with systems in high-trust or high-consequence environments. Within 30 days, complete full remediation across all Chrome instances and validate patch deployment through mobile device management or endpoint detection systems.

Google Chrome CVE-2026-13797

EUVD-2026-40483 CRITICAL

Improper Input Validation (CWE-20)

2026-06-30 chrome-cve-admin@google.com

GHSA-q9mq-f66f-7gf2

Information Disclosure Google Red Hat

9.6

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

9.0 CRITICAL

PR:L rather than PR:N because a compromised renderer (a gained foothold) is a hard prerequisite; UI:R for visiting the page, S:C and C/I/A:H for full sandbox escape.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

9.0 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 20:04 vuln.today

CVE Published

Jun 30, 2026 - 23:16 cve.org

CRITICAL 9.6

CVE Published

Jun 30, 2026 - 23:16 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient validation of untrusted input in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome's Chromecast component (versions prior to 150.0.7871.47) allows an attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page. Rated High by Chromium with a CVSS of 9.6 due to scope change and full CIA impact, this is a second-stage bug typically chained after an initial renderer exploit. No public exploit has been identified at time of analysis and it is not listed in CISA KEV; EPSS is low at 0.21%.

Technical ContextAI

The flaw resides in Chrome's Chromecast (media casting) integration, which handles device discovery and media session negotiation from within the renderer/browser process boundary. The root cause is CWE-20 (Improper Input Validation): the Chromecast code path insufficiently validates untrusted input passed from a renderer, allowing a compromised renderer to influence a more privileged process and escape the sandbox. Chrome's multi-process security model isolates web content in low-privilege renderer processes; a sandbox escape defeats this boundary and grants the attacker the privileges of the higher-trust process. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* confirms the affected product is the Chrome desktop application across platforms.

RemediationAI

Vendor-released patch: update Google Chrome to 150.0.7871.47 or later via the Stable channel; verify through chrome://settings/help which forces an update check and relaunch. Reference Google's advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. In enterprise environments, ensure automatic updates are enabled and push the update through your management tooling (Chrome Enterprise policy / GPO) rather than relying on user-initiated relaunch. As a compensating control until patching, you can reduce the Chromecast attack surface by disabling media casting - for example set the Chrome Enterprise policy EnableMediaRouter=false - which prevents users from casting to Chromecast/Cast devices; the trade-off is loss of legitimate screen/tab casting functionality. Chromium-derived browsers should be updated to the version that incorporates the corresponding upstream fix.