What is the CVSS score of CVE-2026-13805?

CVE-2026-13805 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Google Chrome are affected by CVE-2026-13805?

Google Chrome for macOS versions below 150.0.7871.47 expose the organization to workstation compromise through crafted web content.. A patch is available.

How to fix or mitigate CVE-2026-13805?

Within 24 hours: Issue security advisory to all macOS users directing them to enable automatic Chrome updates and verify their current version. Within 7 days: Confirm that Chrome has updated to version 150.0.7871.47 or later across all managed endpoints; use MDM or configuration management to force deployment if auto-update has not completed. Within 30 days: Audit Chrome version inventory across all macOS systems to document 100% remediation and identify any systems requiring manual intervention.

Google Chrome CVE-2026-13805

EUVD-2026-40491 HIGH

Use After Free (CWE-416)

2026-06-30 chrome-cve-admin@google.com

GHSA-xhpp-2hqr-g6hp

RCE Denial Of Service Google Use After Free Memory Corruption Red Hat Suse

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Remote crafted page needs no privileges (PR:N) and low complexity (AC:L) but requires the victim to open it (UI:R); a renderer use-after-free yields high C/I/A with unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 15:25 vuln.today

CVSS changed

Jul 01, 2026 - 15:22 NVD

8.8 (HIGH)

CVE Published

Jun 30, 2026 - 23:16 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:16 cve.org

HIGH 8.8

DescriptionCVE.org

Use after free in GFX in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome for macOS prior to 150.0.7871.47 stems from a use-after-free in the GFX (graphics) component, allowing a remote attacker to run arbitrary code after a victim opens a crafted HTML page. Chromium rates the severity High and the CVSS is 8.8, but exploitation requires user interaction (visiting a malicious page). There is no public exploit identified at time of analysis and EPSS is low (0.26%, 17th percentile), indicating no observed weaponization yet.

Technical ContextAI

The flaw is a CWE-416 use-after-free in Chrome's GFX/graphics subsystem, which handles rendering and compositing of web content. Use-after-free occurs when memory is freed while a dangling pointer still references it; a crafted page can manipulate object lifetimes so that reused freed memory is controlled by the attacker, enabling type confusion and ultimately code execution within the renderer process. The affected component is the desktop Chrome browser on macOS specifically; the EUVD constrains the affected build to Chrome versions below 150.0.7871.47. No CPE string was provided in the input, so exact CPE-based product matching cannot be confirmed here beyond the Google-supplied version boundary.

RemediationAI

Vendor-released patch: update Google Chrome to 150.0.7871.47 or later on macOS via the Stable channel; verify by opening chrome://settings/help to force the update check and relaunching the browser, and confirm the version is at or above 150.0.7871.47. In managed fleets, push the updated build through your enterprise update/MDM channel and ensure auto-update is not disabled. See Google's advisory: https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. If immediate patching is not possible, the practical interim control is to reduce exposure to untrusted web content - for example restrict browsing to trusted sites or enforce strict URL allowlisting, accepting the usability trade-off; there is no vendor-documented feature toggle that disables the vulnerable GFX code path, so patching is the only reliable fix.