What is the CVSS score of CVE-2026-13845?

CVE-2026-13845 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Google Chrome are affected by CVE-2026-13845?

Google Chrome versions before 150.0.7871.47 contain a remote code execution vulnerability in the DOM implementation that allows attackers to execute arbitrary code on user machines when victims visit…. A patch is available.

How to fix or mitigate CVE-2026-13845?

24 hours: inventory all Chrome versions in use across desktop endpoints and assess your patch management infrastructure. 7 days: deploy Chrome 150.0.7871.47 or later to all systems using your standard update process; prioritize high-risk roles (finance, legal, executive). 30 days: confirm 100% patching completion via endpoint management reporting and decommission any legacy unpatched instances.

Google Chrome CVE-2026-13845

EUVD-2026-40531 HIGH

Use After Free (CWE-416)

2026-06-30 chrome-cve-admin@google.com

GHSA-j88h-8hg6-4p3w

RCE Denial Of Service Google Use After Free Memory Corruption Red Hat Suse

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Remote crafted page needs a victim visit (UI:R) and no privileges (PR:N); impact is high but sandbox-confined so scope stays Unchanged (S:U).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 14:23 vuln.today

CVSS changed

Jul 01, 2026 - 14:22 NVD

8.8 (HIGH)

CVE Published

Jun 30, 2026 - 23:16 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:16 cve.org

HIGH 8.8

DescriptionCVE.org

Use after free in DOM in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Arbitrary code execution in Google Chrome's DOM implementation lets a remote attacker run code within the renderer sandbox by luring a victim to a crafted HTML page. All desktop Chrome builds before 150.0.7871.47 are affected; Chromium rates the flaw High severity. No public exploit has been identified and EPSS probability is low (0.26%), but the vendor patch is already available and should be applied promptly.

Technical ContextAI

The vulnerability is a use-after-free (CWE-416) in Chrome's Document Object Model (DOM) engine - the component in the Blink rendering engine that parses HTML and maintains the live in-memory tree of page objects. A use-after-free occurs when the code frees a heap object but retains and later dereferences a dangling pointer to it; an attacker who controls page content can groom the heap to reallocate that freed slot with attacker-influenced data, corrupting memory and steering control flow. Because DOM manipulation is driven directly by page JavaScript/HTML, this class of bug is a recurring source of remote memory-corruption exploits in browsers. The affected code path executes inside Chrome's multi-process renderer sandbox.

RemediationAI

Vendor-released patch: upgrade Google Chrome to 150.0.7871.47 or later on all desktop platforms, per the Chrome Releases advisory (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html); most installations update automatically, but verify via chrome://settings/help and relaunch to apply, since the fix is inert until restart. In managed fleets, push the updated version through your enterprise management/MDM tooling and confirm minimum-version policies. Users of Chromium-based browsers should apply their vendor's corresponding update once released. As an interim compensating control before patching, restrict exposure to untrusted web content - enabling Chrome's Enhanced Safe Browsing reduces risk of malicious-page delivery, and site isolation (default in Chrome) already constrains a compromised renderer; note these reduce but do not eliminate exposure to a crafted page, so patching remains the only complete fix.