What is the CVSS score of CVE-2026-13814?

CVE-2026-13814 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google are affected by CVE-2026-13814?

Google Chrome desktop browsers contain a remote code execution vulnerability (CVE-2026-13814, CVSS 7.5 HIGH) that could allow attackers to compromise the browser process when users visit a malicious…. A patch is available.

How to fix or mitigate CVE-2026-13814?

Within 24 hours: Inventory all Google Chrome desktop deployments and prepare patch deployment packages for version 150.0.7871.47 or later. Within 7 days: Deploy the patched Chrome version across all endpoints using your standard patch management process. Within 30 days: Verify patch installation through endpoint telemetry and confirm all systems are updated.

Google CVE-2026-13814

EUVD-2026-40500 HIGH

Use After Free (CWE-416)

2026-06-30 chrome-cve-admin@google.com

GHSA-x5q7-8q79-r7mh

Denial Of Service Google Use After Free Memory Corruption Red Hat Suse

7.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 18:35 vuln.today

CVSS changed

Jul 01, 2026 - 16:22 NVD

7.5 (HIGH)

CVE Published

Jun 30, 2026 - 23:16 cve.org

HIGH 7.5

CVE Published

Jun 30, 2026 - 23:16 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Use after free in Views in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Heap corruption via a use-after-free in the Views UI component of Google Chrome allows a remote attacker who serves a crafted HTML page and lures a user into performing specific UI gestures to potentially execute code in the browser process. All desktop Chrome builds prior to 150.0.7871.47 are affected; Google rates the Chromium severity as High and has shipped a fix. No public exploit identified at time of analysis, and EPSS is low (0.21%, 11th percentile).