What is the CVSS score of CVE-2026-13800?

CVE-2026-13800 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-13800?

Google Chrome Updater on Windows contains a local privilege escalation vulnerability affecting versions prior to 150.0.7871.47, allowing attackers with local system access to gain OS-level…. A patch is available.

How to fix or mitigate CVE-2026-13800?

Within 24 hours: Conduct inventory scan of all Windows systems to identify Chrome installations prior to version 150.0.7871.47. Within 7 days: Deploy Chrome 150.0.7871.47 or later (June 2026 Stable Channel) to all affected Windows systems via WSUS, MDM, or equivalent deployment mechanism; communicate mandatory update to users. Within 30 days: Verify deployment completion across 100% of Windows endpoints and audit Chrome version compliance.

Google Chrome CVE-2026-13800

EUVD-2026-40486 HIGH

Improper Access Control (CWE-284)

2026-06-30 chrome-cve-admin@google.com

GHSA-pg94-6h4v-f6ph

Authentication Bypass Privilege Escalation Google Microsoft Red Hat Suse

7.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local attacker needs no prior privileges (PR:N) but a malicious file and user interaction (AV:L, UI:R); successful escalation yields full OS-level compromise, so C/I/A all High.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

7.8 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 15:23 vuln.today

CVSS changed

Jul 01, 2026 - 15:22 NVD

7.8 (HIGH)

CVE Published

Jun 30, 2026 - 23:16 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:16 cve.org

HIGH 7.8

DescriptionCVE.org

Inappropriate implementation in Updater in Google Chrome on Windows prior to 150.0.7871.47 allowed a local attacker to perform OS-level privilege escalation via a malicious file. (Chromium security severity: High)

AnalysisAI

Local privilege escalation in the Google Chrome Updater on Windows (versions prior to 150.0.7871.47) allows a local attacker to gain OS-level privileges by planting a malicious file that the Updater component mishandles. Rated High by Chromium and CVSS 7.8, exploitation requires local access plus user interaction; there is no public exploit identified at time of analysis, and EPSS is low at 0.13% (3rd percentile). A vendor patch is available in the June 2026 Stable Channel release.

Technical ContextAI

The flaw lives in Chrome's Updater on Windows - the auto-update service (Google Update / the elevated updater process) responsible for fetching and installing browser updates, which typically runs with elevated SYSTEM-level privileges. The root cause is classified as CWE-284 (Improper Access Control): the Updater does not adequately restrict how it handles or trusts a file, so an unprivileged local user can supply or influence a malicious file that is then processed in a high-privilege context. This is an 'inappropriate implementation' bug rather than a memory-safety defect, meaning the update/elevation logic itself grants more trust to attacker-controllable input than it should, enabling escalation from a normal Windows user to OS-level control.

RemediationAI

Vendor-released patch: update Google Chrome on Windows to 150.0.7871.47 or later via the June 2026 Stable Channel update (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html), then fully restart the browser so the elevated Updater component is replaced. Because the affected component is the auto-updater, ensure Chrome's background update mechanism (Google Update) is enabled rather than disabled so the fix actually installs; in managed fleets push the update through your standard software-distribution or Chrome Browser Cloud Management channel and verify the running version. As a compensating control until patched, restrict local/interactive logon on sensitive hosts and enforce least-privilege so untrusted users cannot place files in locations the Updater consumes - accepting the trade-off that this limits legitimate multi-user access. No reliable non-update workaround fully removes the flaw, so upgrading is the definitive fix.