What is the CVSS score of CVE-2026-13804?

CVE-2026-13804 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google are affected by CVE-2026-13804?

Google Chrome versions before 150.0.7871.47 contain a sandbox escape vulnerability (CVE-2026-13804, CVSS 8.3) that could allow attackers who have compromised the browser process to gain unrestricted…. A patch is available.

How to fix or mitigate CVE-2026-13804?

Within 24 hours: Use endpoint discovery tools to identify all systems running Chrome versions prior to 150.0.7871.47. Within 7 days: Deploy Chrome 150.0.7871.47 or later organization-wide via your established patch management process. Within 30 days: Verify 100% deployment compliance and audit endpoint detection and response (EDR) logs for suspicious system-level process activity that could indicate exploitation attempts.

Google CVE-2026-13804

EUVD-2026-40490 HIGH

Use After Free (CWE-416)

2026-06-30 chrome-cve-admin@google.com

GHSA-xxhw-p6qc-4j2j

Denial Of Service Google Use After Free Memory Corruption Red Hat Suse

8.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.2 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 18:33 vuln.today

CVSS changed

Jul 01, 2026 - 16:22 NVD

8.3 (HIGH)

CVE Published

Jun 30, 2026 - 23:16 cve.org

HIGH 8.3

CVE Published

Jun 30, 2026 - 23:16 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Use after free in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome's Chromecast component (versions before 150.0.7871.47) lets an attacker who has already compromised the renderer process break out of the browser sandbox and reach the host via a crafted HTML page. Rooted in a use-after-free (CWE-416) memory-corruption bug rated High by Chromium, it carries a CVSS 8.3 driven by a scope change and full CIA impact, but requires a pre-existing renderer compromise, high attack complexity, and user interaction. No public exploit identified at time of analysis, and the low EPSS (0.21%) plus SSVC 'exploitation: none' indicate it is not currently being exploited.