What is the CVSS score of CVE-2026-13843?

CVE-2026-13843 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Chrome for iOS are affected by CVE-2026-13843?

Google Chrome for iOS versions before 150.0.7871.47 contain a critical sandbox escape vulnerability that could fully compromise affected user devices, though no public exploit identified at time of…. A patch is available.

How to fix or mitigate CVE-2026-13843?

Within 24 hours, notify all Chrome for iOS users of the availability of version 150.0.7871.47 or later and initiate expedited patch deployment for managed devices. Within 7 days, complete rollout of Chrome for iOS 150.0.7871.47 or later to all managed devices and strongly recommend voluntary updates to personal devices. Within 30 days, verify patch deployment across the organization, monitor for any indicators of renderer exploits targeting Chrome users, and review access logs for potential compromise of Chrome-using devices.

Chrome for iOS CVE-2026-13843

EUVD-2026-40529 CRITICAL

Improper Input Validation (CWE-20)

2026-06-30 chrome-cve-admin@google.com

GHSA-76x6-x85v-xr2j

Information Disclosure Google Apple Red Hat

9.6

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

Network-delivered via crafted page (AV:N, UI:R) but AC:H because a prior renderer compromise is required; scope changes on sandbox escape (S:C) with total impact (C/I/A:H).

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 19:57 vuln.today

CVE Published

Jun 30, 2026 - 23:16 cve.org

CRITICAL 9.6

CVE Published

Jun 30, 2026 - 23:16 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome for iOS before 150.0.7871.47 lets a remote attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page. Rated High by Chromium and CVSS 9.6 due to the scope change and full compromise potential, though it is a second-stage bug requiring a prior renderer exploit. There is no public exploit identified at time of analysis, and EPSS exploitation probability is low at 0.22% (12th percentile); Google has shipped a fixed version.

Technical ContextAI

The flaw is rooted in CWE-20 (Improper Input Validation): the browser process insufficiently validates untrusted input passed to it from the lower-privilege renderer process. Chromium uses a multi-process architecture in which the sandboxed renderer parses web content while a more privileged browser process brokers access to OS resources; a compromised renderer that sends crafted messages/HTML-derived data can exploit missing validation at the trust boundary to gain the browser process's privileges. On iOS specifically, Chrome is built on Apple's WebKit rather than Blink per App Store policy, so this relates to how Chrome for iOS handles renderer-supplied input within Apple's platform constraints. The CPE data (cpe:2.3:a:google:chrome) identifies the affected application generically as Google Chrome, with EUVD scoping the fix to version 150.0.7871.47.

RemediationAI

Vendor-released patch: 150.0.7871.47 - upgrade Chrome for iOS to 150.0.7871.47 or later via the Apple App Store as the primary fix, per Google's Stable channel advisory (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html). Enable automatic app updates on managed iOS fleets to ensure timely rollout, and force-restart the browser after update so the patched binary is loaded. No standalone workaround fully closes a sandbox-escape bug; as compensating controls while patching, restrict users to trusted sites and avoid loading untrusted HTML, since exploitation still hinges on a prior renderer compromise triggered by malicious web content - but note this reduces usability and does not eliminate risk. There is no port- or feature-toggle mitigation applicable to a client browser flaw of this class.