What is the CVSS score of CVE-2026-13838?

CVE-2026-13838 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-13838?

Yes, a patch is available for CVE-2026-13838. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-13838

EUVD-2026-40524 MEDIUM

Origin Validation Error (CWE-346)

2026-06-30 chrome-cve-admin@google.com

GHSA-cwc7-h32g-jv39

Authentication Bypass Google Suse

6.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

vuln.today AI

7.4 HIGH

SOP bypass inherently crosses origin boundaries warranting S:C; no authentication or special config required; user must visit the page (UI:R); integrity impact is cross-origin, confidentiality not demonstrated.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N

SUSE

MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 16:29 vuln.today

CVSS changed

Jul 01, 2026 - 16:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 30, 2026 - 23:16 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:16 cve.org

MEDIUM 6.5

DescriptionCVE.org

Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Same-origin policy bypass in Google Chrome's CSS implementation allows a remote, unauthenticated attacker to violate cross-origin integrity protections by luring a user to a crafted HTML page. All Chrome versions prior to 150.0.7871.47 are affected. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Attacker crafts malicious HTML/CSS page

Delivery

Victim directed to page via phishing or link

Exploit

Chrome loads page, triggering CSS origin validation flaw

Execution

Same-origin policy check bypassed

Impact

Attacker injects or manipulates cross-origin content

Access

Attacker crafts malicious HTML/CSS page

Delivery

Victim directed to page via phishing or link

Exploit

Chrome loads page, triggering CSS origin validation flaw

Execution

Same-origin policy check bypassed

Impact

Attacker injects or manipulates cross-origin content

Vulnerability AssessmentAI

Exploitation	User interaction is required - the victim must visit an attacker-controlled or attacker-influenced web page using a vulnerable version of Google Chrome (any release prior to 150.0.7871.47). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 base score of 6.5 (Medium) reflects network delivery (AV:N), low attack complexity (AC:L), no required privileges (PR:N), but mandatory user interaction (UI:R). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker hosts a crafted HTML page containing malicious CSS that triggers the origin validation error in Chrome's CSS engine. The victim is directed to the page via phishing, malvertising, or a compromised link; upon page load with minimal interaction, the attacker's page bypasses the same-origin policy and injects or modifies content in another origin's context. …
Remediation	Upgrade to Google Chrome version 150.0.7871.47 or later; this is the vendor-confirmed patched release per the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. … Detailed patch versions, workarounds, and compensating controls in full report.