What is the CVSS score of CVE-2026-13816?

CVE-2026-13816 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-13816?

Yes, a patch is available for CVE-2026-13816. Update the affected software to the latest version immediately.

Google Chrome Android CVE-2026-13816

EUVD-2026-40502 MEDIUM

Improper Input Validation (CWE-20)

2026-06-30 chrome-cve-admin@google.com

GHSA-x454-5847-5cwh

Information Disclosure Google Red Hat Suse

6.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network-delivered via crafted HTML page, no authentication needed, user must actively navigate; scope unchanged as leak is limited to browser context; no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

7.4 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 17:25 vuln.today

CVSS changed

Jul 01, 2026 - 17:22 NVD

6.5 (None) 6.5 (MEDIUM)

CVE Published

Jun 30, 2026 - 23:16 cve.org

MEDIUM 6.5

CVE Published

Jun 30, 2026 - 23:16 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient validation of untrusted input in File Input in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Cross-origin data leakage in Google Chrome for Android prior to 150.0.7871.47 enables remote attackers to read data from other origins via a crafted HTML page exploiting insufficient validation in the File Input component. The flaw is Android-platform-specific, requiring only that a victim user navigate to an attacker-controlled page. No active exploitation has been confirmed (CISA KEV negative, SSVC exploitation: none), and EPSS at 0.21% (11th percentile) reflects low current exploitation interest, though the unauthenticated, low-complexity attack vector keeps it a relevant patching priority for Android Chrome deployments.

Technical ContextAI

The vulnerability resides in Google Chrome's File Input handling (<input type='file'>) on the Android platform. CWE-20 (Improper Input Validation) indicates that the browser fails to sufficiently validate or sanitize untrusted HTML input before processing file-related data, allowing the same-origin policy to be bypassed and enabling cross-origin data leakage. This is an Android-specific manifestation, likely related to how Chrome on Android handles file URI schemes, content providers, or the Android-specific file picker integration differently from desktop builds. The affected CPE scope covers all Chrome builds for Android below version 150.0.7871.47.

RemediationAI

Update Google Chrome on Android to version 150.0.7871.47 or later. This patch is available via the Google Play Store automatic update mechanism or manually through Play Store > Chrome > Update. The vendor advisory is published at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. As a compensating control prior to patching, organizations managing Android devices through MDM can restrict browser-based file input access or enforce Safe Browsing policies to reduce exposure to malicious pages. Note that enterprise fleets using Chrome for Android via managed profiles should prioritize this update specifically on Android endpoints, as the vulnerability does not affect Chrome on other platforms.