What is the CVSS score of CVE-2026-13802?

CVE-2026-13802 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Google Chrome are affected by CVE-2026-13802?

Google Chrome contains a remote code execution vulnerability (CVE-2026-13802) in versions prior to 150.0.7871.47 that allows attackers to execute arbitrary code on user systems through malicious…. A patch is available.

How to fix or mitigate CVE-2026-13802?

Within 24 hours: Issue security notification to all Chrome users with vulnerability details and patch availability. Within 7 days: Deploy Google Chrome version 150.0.7871.47 or later across all systems; verify automatic updates are enabled where possible. Within 30 days: Audit patch deployment compliance and document completion.

Google Chrome CVE-2026-13802

EUVD-2026-40488 HIGH

Use After Free (CWE-416)

2026-06-30 chrome-cve-admin@google.com

GHSA-6h63-qwh3-v8vp

RCE Denial Of Service Google Use After Free Memory Corruption Red Hat Suse

7.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Network-delivered via crafted page (AV:N) but requires a specific user gesture (UI:R) and a hard-to-win UAF race (AC:H), unauthenticated (PR:N), yielding full code-execution impact (C/I/A:H).

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 15:24 vuln.today

CVSS changed

Jul 01, 2026 - 15:22 NVD

7.5 (HIGH)

CVE Published

Jun 30, 2026 - 23:16 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:16 cve.org

HIGH 7.5

DescriptionCVE.org

Use after free in Views in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome (Views UI component) prior to 150.0.7871.47 allows a remote attacker to execute arbitrary code by luring a victim to a crafted HTML page and inducing specific UI gestures that trigger a use-after-free. Rated High by Chromium and CVSS 7.5, the flaw is elevated in complexity by its requirement for user interaction, and no public exploit has been identified at time of analysis; EPSS probability is low at 0.26%.

Technical ContextAI

The vulnerability is a use-after-free (CWE-416) in Chrome's Views framework, the cross-platform C++ UI toolkit that Chromium uses to render browser chrome and native widgets (menus, dialogs, tabs, toolbars). A use-after-free occurs when memory is freed but a dangling pointer is subsequently dereferenced, allowing an attacker to reclaim that memory with attacker-controlled data and corrupt program state. Because Views manages complex object lifetimes tied to user-driven UI events, a crafted page combined with specific gestures can free a Views object while a reference remains live. The affected CPE is Google Chrome desktop builds prior to 150.0.7871.47 across platforms (Windows, macOS, Linux) served through the Stable channel.

RemediationAI

Vendor-released patch: update Google Chrome to 150.0.7871.47 or later via the Stable channel; on most deployments Chrome auto-updates, so ensure the browser is fully relaunched to apply the fix, and verify the version under chrome://settings/help. Enterprises managing Chrome via policy should push the updated build and confirm rollout, per the Chrome release advisory (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html). Users of Chromium-based browsers should apply their vendor's equivalent update once available. There is no clean feature-level workaround since Views is core to the UI; as an interim compensating control, keep Site Isolation enabled (default) and reduce exposure by cautioning users against interacting with untrusted pages, though this does not eliminate the risk and only patching does.