What is the CVSS score of CVE-2026-13830?

CVE-2026-13830 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by CVE-2026-13830?

Google Chrome Remote Desktop on Linux systems is vulnerable to remote code execution via a use-after-free flaw in the Chromoting component (CVE-2026-13830).. A patch is available.

How to fix or mitigate CVE-2026-13830?

Within 24 hours: Inventory all Chrome Remote Desktop instances on Linux and prioritize systems exposed to untrusted networks. Within 7 days: Deploy Chrome version 150.0.7871.47 or later to all affected Linux systems using your standard patch management process. Within 30 days: Audit deployment logs to confirm complete patch coverage across all remote desktop infrastructure.

Google Chrome CVE-2026-13830

EUVD-2026-40516 HIGH

Use After Free (CWE-416)

2026-06-30 chrome-cve-admin@google.com

GHSA-ccfw-x8jh-2gq7

RCE Denial Of Service Google Use After Free Memory Corruption Red Hat Suse

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Adjacent remoting traffic (AV:A) needs no auth or interaction (PR:N/UI:N/AC:L), and use-after-free RCE yields total confidentiality, integrity, and availability impact.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

9.8 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 16:31 vuln.today

CVSS changed

Jul 01, 2026 - 14:22 NVD

8.8 (HIGH)

CVE Published

Jun 30, 2026 - 23:16 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:16 cve.org

HIGH 8.8

DescriptionCVE.org

Use after free in Chromoting in Google Chrome on Linux prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code via malicious network traffic. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome's Chromoting (Chrome Remote Desktop) component on Linux allows an adjacent-network attacker to run arbitrary code by sending malicious network traffic to a vulnerable client before version 150.0.7871.47. The flaw is a use-after-free memory-corruption issue rated High by Chromium and carries a CVSS 8.8. There is no public exploit identified at time of analysis, it is not in CISA KEV, and EPSS is low (0.24%, 15th percentile), indicating no observed exploitation activity yet.

Technical ContextAI

Chromoting is the internal name for Google's Chrome Remote Desktop, the WebRTC/protobuf-based remoting stack embedded in Chrome that brokers screen-sharing and remote-control sessions between peers. The root cause is CWE-416 (Use After Free): the code continues to reference a heap object after it has been freed, so an attacker who controls the timing or content of the remoting network stream can cause the freed memory to be reused with attacker-influenced data, corrupting program state. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* identifies the affected product as the Google Chrome application, with the description scoping the exposure specifically to the Linux build of the Chromoting subsystem prior to 150.0.7871.47.

RemediationAI

Vendor-released patch: 150.0.7871.47 - upgrade Google Chrome on Linux to 150.0.7871.47 or later, per the Chrome Stable channel advisory (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html); on most deployments this happens automatically via Chrome's updater, so verify the effective version at chrome://settings/help and restart the browser to apply. As a compensating control until the update is confirmed, disable or uninstall Chrome Remote Desktop so the vulnerable Chromoting stack is not reachable, avoid accepting remote-desktop sessions from untrusted peers, and segment the network to prevent adjacent attackers from reaching remoting clients (trade-off: these measures break remote-access workflows that rely on Chrome Remote Desktop). The Chromium bug (https://issues.chromium.org/issues/513727494) may remain access-restricted pending broad patch adoption.