What is the CVSS score of CVE-2026-13854?

CVE-2026-13854 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by CVE-2026-13854?

Google Chrome on Linux (versions prior to 150.0.7871.47) contains a CRITICAL sandbox escape vulnerability in the Ozone graphics layer that permits privilege escalation from the renderer process to…. A patch is available.

How to fix or mitigate CVE-2026-13854?

Within 24 hours: Identify all Linux systems running Google Chrome and document current versions; prioritize endpoints in high-risk roles (finance, healthcare, executive). Within 7 days: Deploy Chrome 150.0.7871.47 or later via corporate software distribution channels; validate deployment on 25% of fleet before full rollout. Within 30 days: Audit 100% compliance with version 150.0.7871.47+; document completion in asset management system; review browser security policies to restrict high-risk web content in isolated environments.

Google Chrome CVE-2026-13854

EUVD-2026-40540 CRITICAL

Use After Free (CWE-416)

2026-06-30 chrome-cve-admin@google.com

GHSA-684j-2c36-hw8w

Denial Of Service Google Use After Free Memory Corruption Red Hat Suse

9.6

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.0 HIGH

Requires a prior renderer compromise (modeled as PR:L and AC:H for the chained, heap-grooming-dependent precondition) plus loading a crafted page (UI:R); sandbox escape yields scope change with full browser-process impact.

3.1 AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

8.2 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 16:24 vuln.today

CVSS changed

Jul 01, 2026 - 16:22 NVD

9.6 (CRITICAL)

CVE Published

Jun 30, 2026 - 23:16 cve.org

CRITICAL 9.6

CVE Published

Jun 30, 2026 - 23:16 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome on Linux (versions prior to 150.0.7871.47) stems from a use-after-free in Ozone, Chrome's platform abstraction layer for windowing and graphics. An attacker who has already compromised the renderer process can leverage a crafted HTML page to break out of the browser sandbox and gain code execution at the higher-privileged browser-process level. There is no public exploit identified at time of analysis, and the EPSS score is low (0.21%, 11th percentile), consistent with a second-stage bug that requires a prior renderer compromise rather than a directly weaponizable single-shot flaw.

Technical ContextAI

Ozone is Chromium's abstraction layer that mediates between the browser and the underlying Linux display/graphics stack (X11, Wayland, DRM/GBM), handling window surfaces, input, and buffer management. The root cause is CWE-416 (Use After Free): an object in Ozone is freed while a dangling reference remains reachable, so subsequent access operates on reused or attacker-influenceable memory, enabling corruption of browser-process state. Because Ozone code runs in the privileged browser process (outside the renderer sandbox), a controlled UAF here is a classic primitive for escalating from a sandboxed renderer to full browser-process privileges. The affected component is Linux-specific (Ozone is the Linux/ChromeOS windowing backend), so the same code path does not apply to the Windows or macOS graphics stacks.

RemediationAI

Vendor-released patch: update Google Chrome on Linux to 150.0.7871.47 or later, per the Chrome Stable channel update advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome auto-updates for most users, but on Linux many deployments rely on distribution package managers, so administrators should force a browser restart to apply the update and verify the running version via chrome://version rather than assuming background update completion. Until patched, compensating controls include restricting untrusted web browsing, enforcing site isolation (enabled by default and important to retain), and - since this bug requires a prior renderer compromise - keeping renderer-level vulnerabilities patched to break the chain; note that disabling GPU/hardware acceleration is not a reliable mitigation for an Ozone windowing UAF and may degrade usability without closing the vector. There is no need to disable the sandbox; doing so would worsen exposure.