What is the CVSS score of CVE-2026-13850?

CVE-2026-13850 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-13850?

A vulnerability in Google Chrome iOS (CVE-2026-13850, CVSS 8.8) enables arbitrary code execution within the browser sandbox when users open specially crafted files.. A patch is available.

How to fix or mitigate CVE-2026-13850?

Within 24 hours: Assess Chrome iOS usage across all device categories (corporate-managed, BYOD, personal). Within 7 days: Deploy Chrome 150.0.7871.47 or later via MDM solutions and app store communications; prioritize devices with email, VPN, or data access. Within 30 days: Validate patch deployment across device fleet and implement minimum version requirement.

Google Chrome CVE-2026-13850

EUVD-2026-40536 HIGH

Improper Input Validation (CWE-20)

2026-06-30 chrome-cve-admin@google.com

GHSA-mxr8-rxwp-g4gx

RCE Google Apple Red Hat Suse

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Remote file delivery (AV:N) but requires the user to open it (UI:R); sandboxed execution keeps scope unchanged (S:U) with high impact confined to the browser process.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 14:23 vuln.today

CVSS changed

Jul 01, 2026 - 14:22 NVD

8.8 (HIGH)

CVE Published

Jun 30, 2026 - 23:16 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:16 cve.org

HIGH 8.8

DescriptionCVE.org

Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a local attacker to execute arbitrary code inside a sandbox via a malicious file. (Chromium security severity: High)

AnalysisAI

Sandboxed arbitrary code execution in Google Chrome for iOS before 150.0.7871.47 lets an attacker who convinces a user to open a malicious file run code inside the browser's sandbox due to insufficient validation of untrusted input. Google rates the Chromium severity High and ships the fix in 150.0.7871.47; EPSS is low (0.15%, 4th percentile) and there is no public exploit identified at time of analysis. The flaw requires user interaction (opening the file) and, per the description, the resulting execution is confined to the sandbox rather than the underlying OS.

Technical ContextAI

The affected component is Google Chrome on Apple iOS, tracked by the Chromium project via issue 517610676. The root cause is CWE-20 (Improper Input Validation): the browser fails to sufficiently validate untrusted input in a crafted file, allowing that input to corrupt program state and redirect execution. On iOS, Chrome is built on Apple's WebKit engine (per App Store policy), so the affected surface is Chrome's own file/content-handling code paths rather than the Blink/V8 stack used on desktop. The described outcome - code execution 'inside a sandbox' - indicates the primitive is contained by Chrome's process sandbox and does not, by itself, escape to the host operating system.

RemediationAI

Vendor-released patch: 150.0.7871.47 - upgrade Google Chrome on iOS to 150.0.7871.47 or later via the Apple App Store, per the Chrome Releases advisory (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html). Chrome on iOS updates through the App Store, so ensure automatic app updates are enabled and force-update managed fleets through MDM. As an interim compensating control until updates propagate, instruct users not to open untrusted files (downloads, email/AirDrop attachments, shared links) in Chrome and route unknown documents to a viewer or quarantine instead; the trade-off is user friction and reliance on user judgment. Because exploitation requires opening a malicious file, restricting Chrome's handling of files from untrusted sources reduces exposure at the cost of convenience.