What is the CVSS score of CVE-2026-13846?

CVE-2026-13846 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by CVE-2026-13846?

Google Chrome for macOS versions before 150.0.7871.47 contain a critical sandbox escape vulnerability that allows attackers who have compromised the browser renderer process to escalate privileges…. A patch is available.

How to fix or mitigate CVE-2026-13846?

Within 24 hours: Enumerate Chrome versions across all macOS endpoints using your MDM platform and confirm Chrome 150.0.7871.47 or later is available in your software distribution system. Within 7 days: Deploy Chrome 150.0.7871.47 or later to all macOS systems; ensure automatic updates are enabled to prevent regression. Within 30 days: Validate 100% patch deployment via endpoint inventory and confirm zero systems remain on versions prior to 150.0.7871.47.

Google Chrome CVE-2026-13846

EUVD-2026-40532 CRITICAL

Use After Free (CWE-416)

2026-06-30 chrome-cve-admin@google.com

GHSA-8rcv-2v9q-9vhm

Denial Of Service Google Use After Free Memory Corruption Red Hat Suse

9.6

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

Requires a pre-compromised renderer plus a UAF race and a user-loaded page, so AC:H and UI:R; the sandbox escape crosses the trust boundary (S:C) with total impact on the browser process.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

8.2 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 18:31 vuln.today

CVSS changed

Jul 01, 2026 - 16:22 NVD

9.6 (CRITICAL)

CVE Published

Jun 30, 2026 - 23:16 cve.org

CRITICAL 9.6

CVE Published

Jun 30, 2026 - 23:16 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Use after free in USB in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome for macOS before 150.0.7871.47 lets an attacker who has already compromised the renderer process break out of the browser sandbox by exploiting a use-after-free in the USB subsystem via a crafted HTML page. Rated High by Chromium and CVSS 9.6, it functions as a second-stage escalation primitive rather than a standalone entry point. There is no public exploit identified at time of analysis, and EPSS is low at 0.21% (11th percentile).

Technical ContextAI

The flaw is a CWE-416 use-after-free in Chrome's USB implementation (the browser-process plumbing behind WebUSB/USB device handling). A use-after-free occurs when code continues to reference heap memory after it has been freed, letting an attacker groom the freed allocation with controlled data and hijack the dangling pointer to corrupt memory or divert control flow. Because the affected code runs on the more-privileged side of Chrome's multi-process sandbox boundary, corrupting it from a compromised renderer yields execution in the higher-privilege browser process - a sandbox escape. Per the description the issue is specific to the macOS build; it is tracked internally as Chromium issue 516999424 and externally as EUVD-2026-40532.

RemediationAI

Vendor-released patch: 150.0.7871.47 - update Chrome on macOS to 150.0.7871.47 or later via the Chrome Releases advisory (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html), then fully restart the browser so the new binary loads. In managed fleets, push the update through MDM/enterprise policy and verify the effective running version rather than the installed version. As an interim compensating control, restrict WebUSB via the DefaultWebUsbGuardSetting / WebUsbAskForUrls enterprise policies to deny sites access to USB devices, which shrinks the surface reaching the vulnerable code at the cost of breaking legitimate WebUSB-based web apps; because exploitation also requires a pre-compromised renderer, staying fully patched and enforcing Site Isolation further limits the chain. No standalone workaround fully substitutes for the update.