What is the CVSS score of CVE-2026-13813?

CVE-2026-13813 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by CVE-2026-13813?

Google Chrome for iOS users face a high-severity sandbox escape vulnerability (CVSS 8.3) that allows an attacker who has compromised the browser rendering engine to escape the browser sandbox and…. A patch is available.

How to fix or mitigate CVE-2026-13813?

Within 24 hours: Notify all iOS users and device administrators to update Chrome to version 150.0.7871.47 or later. Within 7 days: Verify Chrome updates to 150.0.7871.47+ across all managed iOS devices and implement MDM policy to block older Chrome versions. Within 30 days: Conduct security assessment of browser isolation effectiveness and review logs for indicators of renderer-level compromise.

Google Chrome CVE-2026-13813

EUVD-2026-40499 HIGH

Improper Input Validation (CWE-20)

2026-06-30 chrome-cve-admin@google.com

GHSA-mccm-g2cw-25j9

Information Disclosure Google Apple Red Hat Suse

8.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

Delivered via web page (AV:N, UI:R) but gated on a prior renderer compromise and defeating sandbox policy (AC:H); sandbox escape crosses trust boundary (S:C) with total impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 18:33 vuln.today

CVSS changed

Jul 01, 2026 - 16:22 NVD

8.3 (HIGH)

CVE Published

Jun 30, 2026 - 23:16 cve.org

HIGH 8.3

CVE Published

Jun 30, 2026 - 23:16 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome for iOS prior to 150.0.7871.47 lets a remote attacker who has already compromised the renderer process break out of the sandbox via a crafted HTML page, escalating from renderer-level code execution to broader access on the device. The flaw stems from insufficient policy enforcement (CWE-20) and carries a High Chromium severity rating with a CVSS 8.3 (scope-changed) score. There is no public exploit identified at time of analysis and it is not in CISA KEV; EPSS probability is low at 0.21% (11th percentile).

Technical ContextAI

The affected component is the iOS build of Google Chrome, which relies on Chromium's multi-process sandbox architecture in which untrusted web content is rendered inside a low-privilege renderer process isolated from the more privileged browser process and OS. This CVE is a second-stage bug: insufficient policy enforcement (CWE-20, Improper Input Validation) at the sandbox boundary allows a renderer that an attacker has already subverted to violate the isolation policy and escape confinement. Because Chrome on iOS must use Apple's WebKit rather than Blink, the sandboxing and policy-enforcement layer here is Chrome's own process/IPC boundary code rather than the desktop V8/Blink renderer, which is why the tags reference both Google and Apple platforms.

RemediationAI

Vendor-released patch: 150.0.7871.47 - update Google Chrome for iOS to 150.0.7871.47 or later via the Apple App Store, which is the primary and complete fix. Because iOS App Store updates can lag, verify installed clients through MDM and force-update or restrict outdated versions where possible; the trade-off is user disruption from forced updates. As an interim compensating control, this bug requires an already-compromised renderer reached through a malicious page, so restricting exposure to untrusted web content (enterprise web filtering, blocking known-malicious domains) reduces the odds of the preceding renderer compromise, at the cost of browsing convenience. Reference the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html and the chromium issue https://issues.chromium.org/issues/508462149.