What is the CVSS score of CVE-2026-13841?

CVE-2026-13841 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by CVE-2026-13841?

Google Chrome versions prior to 150.0.7871.47 contain a sandbox escape vulnerability (CVE-2026-13841, CVSS 8.3) in the Skia graphics engine that allows attackers with renderer process access to…. A patch is available.

How to fix or mitigate CVE-2026-13841?

Within 24 hours, audit your environment to identify systems running Chrome versions prior to 150.0.7871.47 and prioritize internet-facing workstations. Within 7 days, deploy Chrome 150.0.7871.47 or later across all affected systems via your standard patch management process; enable auto-update for unmanaged endpoints to accelerate remediation. Within 30 days, confirm patch deployment through browser telemetry or inventory systems and review web proxy and endpoint logs for anomalous renderer process activity or graphics engine exploit indicators.

Google Chrome CVE-2026-13841

EUVD-2026-40527 HIGH

External Control of Assumed-Immutable Web Parameter (CWE-472)

2026-06-30 chrome-cve-admin@google.com

GHSA-jg42-75rj-r35p

Buffer Overflow Google Red Hat

8.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

Kept AC:H for non-trivial overflow weaponization and UI:R for the crafted page; S:C reflects the renderer-to-browser sandbox escape, with PR:N per Chrome convention though a prior renderer compromise is required.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

HIGH

qualitative

Red Hat

8.2 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 19:58 vuln.today

CVE Published

Jun 30, 2026 - 23:16 cve.org

HIGH 8.3

CVE Published

Jun 30, 2026 - 23:16 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Integer overflow in Skia in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome's Skia graphics engine (versions prior to 150.0.7871.47) lets an attacker who has already compromised the renderer process break out of the sandbox and execute code in the more privileged browser context via a crafted HTML page. Google rates the Chromium severity as High, and a fixed stable-channel build is available. There is no public exploit identified at time of analysis, EPSS is low (0.21%, 11th percentile), and SSVC records exploitation status as none.

Technical ContextAI

Skia is the open-source 2D graphics rasterization library that Chromium (and downstream browsers such as Chrome, Edge, and others) uses to render canvas, SVG, CSS, and general web page compositing. An integer overflow in Skia's handling of attacker-influenced geometry/size values can cause undersized allocations or out-of-bounds memory operations, which - when reached from an already-compromised renderer - provides a primitive usable to escape Chrome's multi-process sandbox into the browser process. Note a data discrepancy: the description explicitly says 'integer overflow' (normally CWE-190), but the assigned weakness is CWE-472 (External Control of Assumed-Immutable Web Parameter), which does not match the described flaw class; the description text should be treated as authoritative here. Affected code is identified only broadly by CPE cpe:2.3:a:google:chrome:*, with the fix landing in Chrome 150.0.7871.47.

RemediationAI

Vendor-released patch: update Google Chrome to 150.0.7871.47 or later on all desktop platforms via the stable channel, then fully restart the browser so the new build loads (per https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html). For managed fleets, push the update through enterprise policy/auto-update and verify the reported version. Users of other Chromium-based browsers should apply the equivalent vendor build once it incorporates the Skia fix, and SUSE/Linux distribution users should track their packaged Chromium updates. No standalone workaround fully neutralizes a graphics-engine memory bug, but interim risk can be reduced by keeping the renderer sandbox intact (do not disable the sandbox), avoiding untrusted sites, and - where policy allows - restricting/isolating browsing of untrusted content; these controls reduce, but do not eliminate, exposure and do not substitute for the patch.