What is the CVSS score of CVE-2026-13817?

CVE-2026-13817 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by CVE-2026-13817?

Google Chrome versions prior to 150.0.7871.47 contain a sandbox escape vulnerability (CVE-2026-13817, CVSS 8.8) that allows attackers to break out of browser isolation when users visit malicious…. A patch is available.

How to fix or mitigate CVE-2026-13817?

Within 24 hours: Inventory all Chrome versions deployed across the organization and identify systems running versions prior to 150.0.7871.47. Within 7 days: Deploy Chrome 150.0.7871.47 or later through standard patch management processes. Within 30 days: Verify 100% deployment completion and confirm no vulnerable versions remain in active use.

Google Chrome CVE-2026-13817

EUVD-2026-40503 HIGH

Improper Input Validation (CWE-20)

2026-06-30 chrome-cve-admin@google.com

GHSA-mcqp-c62v-fcg4

Information Disclosure Google Red Hat Suse

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Remote crafted page (AV:N/AC:L/PR:N) requiring the victim to open it (UI:R); a sandbox escape yields high C/I/A within the renderer's trust boundary without scope change.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 18:31 vuln.today

CVSS changed

Jul 01, 2026 - 16:22 NVD

8.8 (HIGH)

CVE Published

Jun 30, 2026 - 23:16 cve.org

HIGH 8.8

CVE Published

Jun 30, 2026 - 23:16 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient validation of untrusted input in Glic in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome versions prior to 150.0.7871.47 stems from insufficient input validation in the Glic component, allowing a remote attacker who lures a victim to a crafted HTML page to potentially break out of the renderer sandbox. The flaw carries a CVSS 8.8 (High) rating and requires user interaction (visiting a malicious page); there is no public exploit identified at time of analysis and EPSS estimates only a 0.21% exploitation probability. A vendor patch is available and the issue is not listed in CISA KEV.

Technical ContextAI

The vulnerability lives in Glic, a Google Chrome browser feature/component, and is classified as CWE-20 (Improper Input Validation). Chrome's multi-process security model isolates untrusted web content inside a sandboxed renderer; a sandbox escape means untrusted input processed by the affected component can cross that trust boundary toward higher-privileged browser processes. Because the root cause is insufficient validation of untrusted input reachable from web content, a crafted HTML page can drive the component into an unexpected state. The EUVD entry (EUVD-2026-40503) and Chrome release notes tie the fix to the 150.0.7871.47 stable channel build on desktop.

RemediationAI

Vendor-released patch: update Google Chrome to 150.0.7871.47 or later via the stable desktop channel, then relaunch the browser to complete the update (verify under chrome://settings/help). Chromium-based browsers (Edge, Brave, Opera, etc.) should apply their corresponding upstream-rebased releases once available. Refer to the Chrome Releases advisory (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html) for exact build details. Because exploitation requires the user to load a malicious page, an interim compensating control is to restrict browsing to trusted sites and enforce update policies via enterprise management (e.g., Chrome ADMX/policy to auto-update and pin minimum version); the trade-off is that these controls reduce but do not eliminate exposure until the patched build is deployed.