What is the CVSS score of CVE-2026-13806?

CVE-2026-13806 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by CVE-2026-13806?

Google Chrome versions before 150.0.7871.47 contain a high-severity site-isolation bypass in the Accessibility component that could enable attackers already inside the browser process to escape…. A patch is available.

How to fix or mitigate CVE-2026-13806?

Within 24 hours, assess Chrome versions across all user endpoints and identify any instances running below 150.0.7871.47. Within 7 days, deploy Chrome 150.0.7871.47 or later organization-wide through automated update mechanisms or manual rollout depending on your deployment model; test for compatibility with line-of-business applications before broad rollout. Within 30 days, validate patch coverage across all Chrome installations through your endpoint management tools and audit logs, and ensure continuous auto-update mechanisms are enabled to prevent future version drift.

Google Chrome CVE-2026-13806

EUVD-2026-40492 HIGH

Improper Input Validation (CWE-20)

2026-06-30 chrome-cve-admin@google.com

GHSA-m39p-2h74-v77q

Authentication Bypass Google Red Hat

8.1

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

vuln.today AI

5.7 MEDIUM

Requires a pre-compromised renderer (PR:H) and chaining plus user navigation (AC:H, UI:R), yielding high confidentiality/integrity but no availability impact within an unchanged scope.

3.1 AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:N/PR:H/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

8.7 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 20:02 vuln.today

CVE Published

Jun 30, 2026 - 23:16 cve.org

HIGH 8.1

CVE Published

Jun 30, 2026 - 23:16 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient validation of untrusted input in Accessibility in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Site-isolation bypass in Google Chrome desktop before 150.0.7871.47 lets an attacker who has already compromised the renderer process escape cross-origin protections through insufficient input validation in the Accessibility component via a crafted HTML page. Rated High by Chromium and CVSS 8.1, it is a second-stage primitive rather than an initial-access flaw; no public exploit has been identified and EPSS exploitation probability is low (0.22%). It requires an existing renderer compromise plus a user visiting a malicious page, so it is realistically a chained-exploit component.

Technical ContextAI

Chrome's multi-process architecture confines untrusted web content inside sandboxed renderer processes, and Site Isolation enforces that each site runs in its own process so a compromised renderer cannot read another origin's data. The Accessibility subsystem builds an accessibility tree from page content and communicates it to the privileged browser process; because it processes structured data crossing the renderer/browser trust boundary, insufficient validation (CWE-20, Improper Input Validation) of that untrusted input can be abused to violate the site-isolation guarantee. The single affected product is the Google Chrome application (cpe:2.3:a:google:chrome), with the Chromium engine meaning downstream Chromium-based browsers may share the underlying defect.

RemediationAI

Vendor-released patch: Google Chrome 150.0.7871.47 - upgrade all desktop Chrome installations to 150.0.7871.47 or later and restart the browser to complete the update, per the Chrome Stable channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. In enterprise fleets, force the update through Google Update/Chrome Browser Cloud Management policies and verify the running version via chrome://settings/help rather than assuming background updates completed. Users of Chromium-based browsers (Edge, Brave, Opera, and the SUSE-packaged Chromium) should apply their vendor's build once it rebases onto the fixed Chromium. There is no clean pre-patch workaround because the flaw sits in core Accessibility handling; as a compensating control you can limit exposure by ensuring the sandbox and Site Isolation remain enabled (do not launch Chrome with --disable-site-isolation-trials or --no-sandbox) and by restricting users from browsing untrusted pages, accepting that this only reduces, not eliminates, the chained-attack risk.