What is the CVSS score of CVE-2026-13811?

CVE-2026-13811 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Google Chrome are affected by CVE-2026-13811?

Google Chrome versions before 150.0.7871.47 contain a use-after-free vulnerability in the Input Method Editor that allows remote code execution when users visit malicious web pages.. A patch is available.

How to fix or mitigate CVE-2026-13811?

Within 24 hours: Inventory Chrome installations across managed devices and identify deployed versions. Within 7 days: Deploy Google Chrome 150.0.7871.47 or later to all endpoints via your patch management system; prioritize systems handling sensitive data. Within 30 days: Confirm deployment completion, monitor Chrome update logs for failed installations, and review endpoint telemetry for indicators of exploitation.

Google Chrome CVE-2026-13811

EUVD-2026-40497 HIGH

Use After Free (CWE-416)

2026-06-30 chrome-cve-admin@google.com

GHSA-cw27-h8qh-jv94

RCE Denial Of Service Google Use After Free Memory Corruption Red Hat Suse

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Remote crafted page (AV:N/AC:L/PR:N) needs the victim to load it (UI:R); code runs in the renderer sandbox without scope change (S:U), with high C/I/A within that process.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 15:25 vuln.today

CVSS changed

Jul 01, 2026 - 15:22 NVD

8.8 (HIGH)

CVE Published

Jun 30, 2026 - 23:16 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:16 cve.org

HIGH 8.8

DescriptionCVE.org

Use after free in IME in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Renderer-process remote code execution in Google Chrome desktop before 150.0.7871.47 stems from a use-after-free in the Input Method Editor (IME) component, letting a remote attacker run arbitrary code within the browser's sandbox when a victim visits a crafted HTML page. Rated High by Chromium and CVSS 8.8, it requires user interaction (visiting a page) but no authentication. No public exploit identified at time of analysis, and the EPSS score is low (0.26%, 17th percentile), indicating no evidence of widespread exploitation yet.

Technical ContextAI

The flaw is a CWE-416 use-after-free in Chrome's IME subsystem, the component that mediates composed text input (used heavily for CJK and other complex-script entry) between the OS input framework and the renderer. In a use-after-free, code retains and dereferences a pointer to heap memory that has already been freed, allowing an attacker who controls subsequent heap allocations to groom the freed region and hijack control flow. Per the EUVD/NVD data the affected code is in the Chromium renderer, and the description explicitly notes execution occurs 'inside a sandbox,' meaning code runs in the constrained renderer process rather than at OS privilege - a further sandbox-escape bug would be needed for full host compromise. The Chromium issue tracker entry (issues.chromium.org/issues/506149253) is access-restricted per Google's standard embargo policy.

RemediationAI

Vendor-released patch: update Google Chrome to 150.0.7871.47 or later on all desktop platforms, as announced in the Chrome Releases stable channel update (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html); Chrome typically auto-updates, so verify via chrome://settings/help and relaunch to apply the pending update, and confirm managed/enterprise fleets are not pinning an older build. There is no separate configuration workaround for this memory-corruption bug, so patching is the only reliable fix. As an interim compensating control before the update lands, restrict exposure to untrusted web content - for example enforce enterprise policies that keep the site-isolation/sandbox protections enabled and, for high-risk users, limit browsing to trusted sites; note these controls reduce but do not eliminate risk and can disrupt normal browsing, so they are stopgaps only. Users on unsupported/EOL platforms that no longer receive the patched build should migrate to a supported OS or an updated Chromium-based browser.