What is the CVSS score of CVE-2026-13799?

CVE-2026-13799 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by CVE-2026-13799?

Google Chrome versions prior to 150.0.7871.47 contain a critical vulnerability in the QUIC protocol that could enable remote code execution through malicious websites.. A patch is available.

How to fix or mitigate CVE-2026-13799?

Within 24 hours: Identify all Chrome installations and their versions using your endpoint detection and response (EDR), Mobile Device Management (MDM), or software asset management (SAM) tools. Within 7 days: Deploy Chrome 150.0.7871.47 or later through your standard patch management process and enable automatic updates for subsequent releases. Within 30 days: Audit 100% deployment completion across all managed devices and establish logging for QUIC protocol errors or browser crashes that may indicate exploitation attempts.

Google Chrome CVE-2026-13799

EUVD-2026-40485 HIGH

Use After Free (CWE-416)

2026-06-30 chrome-cve-admin@google.com

GHSA-282h-vfc3-82h7

Denial Of Service Google Use After Free Memory Corruption Red Hat Suse

8.1

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Network-reachable QUIC traffic (AV:N) with no auth (PR:N) but a hard-to-win use-after-free race (AC:H); a successful UAF yields full process compromise, so C/I/A:H.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

9.8 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 19:31 vuln.today

CVSS changed

Jul 01, 2026 - 17:22 NVD

8.1 (None) 8.1 (HIGH)

CVE Published

Jun 30, 2026 - 23:16 cve.org

HIGH 8.1

CVE Published

Jun 30, 2026 - 23:16 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Use after free in QUIC in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to potentially exploit heap corruption via malicious network traffic. (Chromium security severity: High)

AnalysisAI

Heap corruption in Google Chrome's QUIC networking stack (versions prior to 150.0.7871.47) stems from a use-after-free that a remote attacker can trigger through crafted network traffic, potentially leading to arbitrary code execution in the affected browser process. Google rated the Chromium security severity as High and has shipped a fixed Stable-channel build; there is no public exploit identified at time of analysis and CISA's SSVC records exploitation status as 'none'. EPSS is low (0.19%, 9th percentile), indicating no observed weaponization despite a total technical-impact rating.

Technical ContextAI

The flaw is a CWE-416 Use-After-Free in Chrome's implementation of QUIC, the UDP-based transport protocol underpinning HTTP/3. QUIC connection and stream state is managed by complex, event-driven object lifecycles; a use-after-free arises when a heap object tied to a QUIC session or stream is freed while a dangling pointer to it is still dereferenced, corrupting the heap. Because QUIC processing occurs as part of Chrome's network handling, malformed or maliciously sequenced packets can drive the connection state machine into the vulnerable free-then-use path. The affected component is the desktop Google Chrome browser (all platforms served by the Stable channel build below 150.0.7871.47); the reporter is Google's own Chrome CVE team (chrome-cve-admin@google.com), and the underlying issue is tracked internally at Chromium issue 499252371.

RemediationAI

Vendor-released patch: update Google Chrome to 150.0.7871.47 or later via the Stable channel, as described in the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html, and relaunch the browser so the staged update takes effect. In managed fleets, push the update through enterprise management (Google Admin console / GPO / MDM) and force a browser restart. If patching cannot be completed immediately, a targeted compensating control is to disable QUIC to remove the vulnerable code path from active use - turn off the 'Experimental QUIC protocol' flag or apply the enterprise policy QuicAllowed=false; the trade-off is loss of HTTP/3 performance and a fallback to TCP/HTTP2, which is generally acceptable and reversible. Users of other Chromium-based browsers should apply their vendor's corresponding update once available.