What is the CVSS score of CVE-2026-13839?

CVE-2026-13839 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-13839?

Yes, a patch is available for CVE-2026-13839. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-13839

EUVD-2026-40525 MEDIUM

Origin Validation Error (CWE-346)

2026-06-30 chrome-cve-admin@google.com

GHSA-hv8m-gvvc-r98w

Authentication Bypass Google Red Hat

6.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

vuln.today AI

8.2 HIGH

SOP bypass inherently crosses security scope boundaries (S:C); low confidentiality impact added since cross-origin access can leak some data alongside integrity manipulation.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:L/SI:L/SA:N

SUSE

MEDIUM

qualitative

Red Hat

7.4 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 19:59 vuln.today

CVE Published

Jun 30, 2026 - 23:16 cve.org

MEDIUM 6.5

CVE Published

Jun 30, 2026 - 23:16 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Same-origin policy bypass in Google Chrome's CSS engine allows a remote, unauthenticated attacker to undermine web isolation guarantees by serving a crafted HTML page to an unsuspecting user. All Chrome releases prior to 150.0.7871.47 are affected. No public exploit code or active exploitation has been confirmed; SSVC rates exploitation as 'none' and EPSS sits at the 13th percentile, placing real-world urgency below what the I:H CVSS score alone might suggest.

Technical ContextAI

CWE-346 (Origin Validation Error) identifies the root cause: Chrome's CSS subsystem failed to correctly enforce the boundary between distinct web origins, a foundational browser security primitive. The same-origin policy (SOP) prevents scripts and style computations in one origin from reading or manipulating resources belonging to another origin. An 'inappropriate implementation' in the CSS engine introduced a code path that did not correctly validate or reject cross-origin operations, enabling an attacker-controlled page to influence rendering or resource handling in a victim's other open origins. The affected scope per CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* for all versions below 150.0.7871.47, consistent with EUVD-2026-40525 reporting the boundary as 'Chrome 150.0.7871.47 < 150.0.7871.47'.

RemediationAI

Update Google Chrome to version 150.0.7871.47 or later; this is the vendor-released patch confirmed via the Chrome Releases blog at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome typically auto-updates, but administrators managing enterprise fleets should verify deployment of 150.0.7871.47 via policy tools. Users on Linux distributions (noted SUSE tag) should apply the corresponding Chromium package update through their distribution's package manager once available. If immediate patching is operationally constrained, a temporary compensating control is to restrict or block access to untrusted external web content via web proxy policies, though this carries significant usability trade-offs. There is no known configuration flag to disable the vulnerable CSS code path without disabling CSS rendering entirely, making patching the only precise remediation.