What is the CVSS score of CVE-2026-13798?

CVE-2026-13798 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by CVE-2026-13798?

Google Chrome versions prior to 150.0.7871.47 contain a critical sandbox escape vulnerability affecting all desktop users, with no public exploit identified at time of analysis.. A patch is available.

How to fix or mitigate CVE-2026-13798?

Within 24 hours: Inventory Chrome deployments across the organization and confirm your update mechanism (auto-update, managed rollout, or manual). Within 7 days: Deploy Chrome 150.0.7871.47 or later-test in a limited user group first if managing enterprise builds to confirm no compatibility issues. Within 30 days: Verify patch compliance; audit that 100% of Chrome instances report version 150.0.7871.47 or later.

Google Chrome CVE-2026-13798

EUVD-2026-40484 CRITICAL

Heap-based Buffer Overflow (CWE-122)

2026-06-30 chrome-cve-admin@google.com

GHSA-9wxf-mr7j-397m

Buffer Overflow Google Heap Overflow Red Hat Suse

9.6

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

9.6 CRITICAL

Reachable from a crafted web page (AV:N, UI:R) with a sandbox-crossing scope change (S:C) and full code execution (C/I/A:H); PR:N retained per Chromium browser-context scoring though a prior renderer compromise is a practical prerequisite.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

9.0 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 19:30 vuln.today

CVSS changed

Jul 01, 2026 - 17:22 NVD

9.6 (None) 9.6 (CRITICAL)

CVE Published

Jun 30, 2026 - 23:16 cve.org

CRITICAL 9.6

CVE Published

Jun 30, 2026 - 23:16 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Heap buffer overflow in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome desktop versions prior to 150.0.7871.47 stems from a heap buffer overflow in the Chromecast component, letting an attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page. Rated High by Chromium and CVSS 9.6, but it is a second-stage bug requiring prior renderer control, and there is no public exploit identified at time of analysis (SSVC exploitation: none, EPSS 0.22%). No CISA KEV listing exists, indicating no confirmed active exploitation.

Technical ContextAI

The flaw is a CWE-122 heap-based buffer overflow inside Chrome's Chromecast (media casting/receiver) functionality, which handles device discovery and media streaming to Cast targets. Chromium's multi-process architecture confines untrusted web content to a low-privilege, sandboxed renderer process; a sandbox escape bug like this abuses memory corruption reachable from a compromised renderer to write outside allocated heap bounds and gain code execution in a higher-privileged browser context. Affected products per EUVD are Chrome builds before 150.0.7871.47; the underlying Chromium engine means Chromium-based browsers (Edge, Brave, Opera, etc.) may inherit the same defect until they rebase.

RemediationAI

Vendor-released patch: Google Chrome 150.0.7871.47 - update to this version or later via the Stable channel (Help > About Google Chrome, then relaunch) as described in the Chrome Releases advisory (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html). Because Chrome auto-updates, ensure managed fleets are not pinned to an older milestone and force a relaunch to apply the update. If immediate patching is not possible, compensating controls include disabling or restricting Chromecast/media casting for managed users via enterprise policy (the EnableMediaRouter policy set to Disabled removes the casting attack surface, at the cost of losing Cast-to-device functionality) and constraining browsing of untrusted sites, since the bug is triggered from a crafted HTML page after renderer compromise. Chromium-based browser users should apply the equivalent vendor build once released.