What is the CVSS score of CVE-2026-13828?

CVE-2026-13828 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Is there a patch available for CVE-2026-13828?

Yes, a patch is available for CVE-2026-13828. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-13828

EUVD-2026-40514 MEDIUM

Improper Access Control (CWE-284)

2026-06-30 chrome-cve-admin@google.com

GHSA-frg2-jw92-vc8v

Authentication Bypass Google Suse

6.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Web-delivered exploit via crafted HTML requires victim navigation (UI:R, PR:N); memory read yields confidentiality loss only, no write or crash capability (I:N, A:N).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 04:32 vuln.today

CVSS changed

Jul 01, 2026 - 02:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 30, 2026 - 23:16 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:16 cve.org

MEDIUM 6.5

DescriptionCVE.org

Inappropriate implementation in Enterprise in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Memory disclosure in Google Chrome's Enterprise policy implementation exposes sensitive process memory contents to remote attackers who can direct victims to a crafted HTML page. All Chrome desktop releases prior to 150.0.7871.47 are affected. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Attacker crafts malicious HTML page exploiting Enterprise component

Delivery

Victim lured to page via phishing or malvertising

Exploit

Chrome Enterprise implementation processes crafted HTML

Execution

Improper access control exposes process memory

Impact

Attacker reads sensitive in-memory data

Access

Attacker crafts malicious HTML page exploiting Enterprise component

Delivery

Victim lured to page via phishing or malvertising

Exploit

Chrome Enterprise implementation processes crafted HTML

Execution

Improper access control exposes process memory

Impact

Attacker reads sensitive in-memory data

Vulnerability AssessmentAI

Exploitation	The victim must be running a Google Chrome desktop version prior to 150.0.7871.47 and must actively navigate to or be redirected to a crafted HTML page controlled by the attacker (UI:R is confirmed by the CVSS vector). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 6.5 base score reflects a network-accessible, low-complexity attack requiring only user interaction - no attacker-side privileges needed - with high confidentiality impact but no integrity or availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker registers or compromises a website and embeds a crafted HTML page that triggers the inappropriate memory access path in Chrome's Enterprise component. A targeted employee at an organization using managed Chrome is socially engineered - via phishing email or malicious advertisement - into visiting the page, after which the attacker's code reads regions of the Chrome process memory, potentially capturing session tokens, cached credentials, or other sensitive in-memory data. …
Remediation	The primary remediation is upgrading Google Chrome to version 150.0.7871.47 or later, as confirmed by the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. … Detailed patch versions, workarounds, and compensating controls in full report.