What is the CVSS score of CVE-2026-13849?

CVE-2026-13849 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-13849?

Google Chrome on Windows (versions prior to 150.0.7871.47) contains a sandbox escape in the Chromoting component that allows attackers to gain full system control when users open malicious files,…. A patch is available.

How to fix or mitigate CVE-2026-13849?

Within 24 hours, inventory all Windows systems running Chrome versions prior to 150.0.7871.47 and schedule deployment of Chrome 150.0.7871.47 through your standard patch management system. Within 7 days, deploy the patch to all Windows endpoints, prioritizing user-facing and high-value systems. Within 30 days, complete rollout across the entire Windows Chrome fleet, verify compliance through endpoint telemetry or managed browser reporting, and confirm zero systems remain on vulnerable versions.

Google Chrome CVE-2026-13849

EUVD-2026-40535 HIGH

Improper Input Validation (CWE-20)

2026-06-30 chrome-cve-admin@google.com

GHSA-fq63-rh33-g8gg

Information Disclosure Google Microsoft Red Hat

8.6

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.6 HIGH

AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.6 HIGH

Local malicious-file delivery with required user interaction (AV:L/UI:R), no privileges needed (PR:N), and a sandbox escape that changes scope with total host impact (S:C, C/I/A:H).

3.1 AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

HIGH

qualitative

Red Hat

8.1 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 19:57 vuln.today

CVE Published

Jun 30, 2026 - 23:16 cve.org

HIGH 8.6

CVE Published

Jun 30, 2026 - 23:16 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient validation of untrusted input in Chromoting in Google Chrome on Windows prior to 150.0.7871.47 allowed a local attacker to potentially perform a sandbox escape via a malicious file. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome's Chromoting (Chrome Remote Desktop) component on Windows versions prior to 150.0.7871.47 allows a local attacker to break out of the browser sandbox by getting a victim to open a malicious file. Google rates the Chromium severity as High, and while a vendor patch is available, EPSS is low (0.13%) and CISA SSVC records no known exploitation, so this is no public exploit identified at time of analysis. The scope-changing, high-impact nature (full confidentiality, integrity and availability loss beyond the sandbox boundary) makes it a meaningful patch priority for Windows Chrome fleets despite requiring user interaction.

Technical ContextAI

The flaw lives in Chromoting, the code powering Chrome Remote Desktop, which brokers remote-desktop sessions through Chrome and normally runs constrained by the Chromium sandbox. The root cause is CWE-20 (Improper Input Validation): untrusted input carried by a malicious file is not adequately validated before use, letting an attacker cross a trust boundary. Because the CVSS scope is Changed (S:C), successful exploitation escapes the renderer/sandbox and gains privileges of the surrounding host context. The affected component is identified only as Google Chrome on Windows (cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*); the CPE does not enumerate exact ranges, but the EUVD advisory pins all builds before 150.0.7871.47 on the Windows platform specifically.

RemediationAI

Vendor-released patch: update Google Chrome on Windows to 150.0.7871.47 or later via the Desktop Stable channel; verify the version under chrome://settings/help and restart the browser to complete the update, and for managed fleets push the release through your enterprise update mechanism (Google Update / policy). The advisory is at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Where immediate patching is not possible, reduce exposure to the affected feature by disabling or blocking Chrome Remote Desktop / Chromoting (for example via enterprise policy such as RemoteAccessHostFirewallTraversal / RemoteAccessHostClientDomainList restrictions) and by preventing users from opening untrusted files that could trigger the flaw; note the trade-off that disabling Chromoting breaks legitimate remote-desktop workflows for users who rely on it. These are compensating controls only - applying the 150.0.7871.47 update is the definitive fix.