What is the CVSS score of CVE-2026-13815?

CVE-2026-13815 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Google Chrome are affected by CVE-2026-13815?

Google Chrome versions prior to 150.0.7871.47 contain a critical remote code execution vulnerability (CVE-2026-13815, CVSS 8.8) that allows attackers to execute arbitrary code on employee systems…. A patch is available.

How to fix or mitigate CVE-2026-13815?

24 hours: Identify all Chrome instances in the organization and begin staged deployment of Chrome 150.0.7871.47 or later. 7 days: Complete patching of all critical and production systems; verify deployment status through endpoint management tools. 30 days: Enforce minimum Chrome version 150.0.7871.47 through security policy and block older versions from receiving updates.

Google Chrome CVE-2026-13815

EUVD-2026-40501 HIGH

Use After Free (CWE-416)

2026-06-30 chrome-cve-admin@google.com

GHSA-rgw6-446j-4gh8

RCE Denial Of Service Google Use After Free Memory Corruption Red Hat Suse

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Remote crafted-page delivery gives AV:N/AC:L/PR:N, but the victim must open the page (UI:R); renderer memory-corruption RCE yields C:H/I:H/A:H with S:U as impact stays in the sandbox.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 15:26 vuln.today

CVSS changed

Jul 01, 2026 - 15:22 NVD

8.8 (HIGH)

CVE Published

Jun 30, 2026 - 23:16 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:16 cve.org

HIGH 8.8

DescriptionCVE.org

Use after free in Blink in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome's Blink rendering engine (versions prior to 150.0.7871.47) allows a remote attacker to run arbitrary code inside the renderer sandbox by luring a victim to a crafted HTML page. The flaw is a use-after-free (CWE-416) rated High by Chromium and 8.8 (CVSS 3.1); it requires user interaction (visiting a malicious page) and no privileges. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, with a low EPSS of 0.26% (17th percentile).

Technical ContextAI

Blink is the rendering engine underpinning Chromium-based browsers (Chrome, and by extension Edge, Brave, Opera and others), responsible for parsing HTML/CSS and executing DOM operations. The root cause is a use-after-free (CWE-416): an object is freed while a dangling pointer or reference to it remains reachable, and subsequent access to that stale memory lets an attacker control freed heap contents to corrupt memory and hijack control flow. Because the bug lives in the renderer process, arbitrary code execution is confined to the Blink/renderer sandbox per the description; a separate sandbox-escape primitive would be required to reach the host OS. The affected CPE scope is Google Chrome desktop builds below 150.0.7871.47.

RemediationAI

Vendor-released patch: update Google Chrome to 150.0.7871.47 or later via the Chrome Releases stable channel update (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html); restart the browser to apply the update since Chrome staging does not take effect until relaunch. In managed fleets, push the update through enterprise policy or your software distribution tooling and verify the reported version in chrome://settings/help. If immediate patching is not possible, reduce exposure by enabling Chrome's Enhanced Safe Browsing, restricting browsing to trusted sites, and applying the site-isolation and renderer-hardening defaults (do not disable the sandbox), accepting that these lower but do not eliminate the risk of a malicious HTML page triggering the use-after-free.