What is the CVSS score of CVE-2026-13855?

CVE-2026-13855 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Google Chrome are affected by CVE-2026-13855?

Google Chrome on Linux versions prior to 150.0.7871.47 contain a remote code execution vulnerability in the Ozone platform layer.. A patch is available.

How to fix or mitigate CVE-2026-13855?

Within 24 hours: inventory Chrome deployments on Linux and identify systems running versions prior to 150.0.7871.47. Within 7 days: begin staged rollout of Chrome 150.0.7871.47 or later to test and production environments. Within 30 days: complete patching and verify compliance through endpoint management tools.

Google Chrome CVE-2026-13855

EUVD-2026-40541 HIGH

Use After Free (CWE-416)

2026-06-30 chrome-cve-admin@google.com

GHSA-7696-7rqf-77fc

RCE Denial Of Service Google Use After Free Memory Corruption Red Hat Suse

7.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Network-delivered crafted page (AV:N) with no auth (PR:N) but mandatory specific gestures (UI:R) and hard-to-trigger UAF (AC:H); memory corruption yields full C/I/A impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 14:24 vuln.today

CVSS changed

Jul 01, 2026 - 14:22 NVD

7.5 (HIGH)

CVE Published

Jun 30, 2026 - 23:16 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:16 cve.org

HIGH 7.5

DescriptionCVE.org

Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Remote code execution in Google Chrome on Linux (versions prior to 150.0.7871.47) stems from a use-after-free in the Ozone platform layer, allowing a remote attacker who lures a victim into performing specific UI gestures on a crafted HTML page to execute arbitrary code in the browser context. Rated High by Chromium and CVSS 7.5, exploitation is gated by required user interaction and high attack complexity. There is no public exploit identified at time of analysis, and the EPSS probability is low at 0.26% (17th percentile).

Technical ContextAI

Ozone is Chromium's abstraction layer for windowing, display, and input handling on Linux, mediating between the browser and the underlying platform (X11/Wayland). The flaw is a CWE-416 Use-After-Free: an object in the Ozone subsystem is freed while a dangling reference remains reachable, and subsequent access to that freed memory can be manipulated by an attacker to corrupt the heap and hijack control flow. The Chromium references (issue 524395469) and the June 2026 Stable channel update confirm the component; because the bug is in native rendering/input plumbing rather than the JavaScript sandbox alone, a successful trigger yields code execution in the affected process, though typically still subject to Chrome's renderer sandbox unless further escalated.

RemediationAI

Vendor-released patch: update Google Chrome to 150.0.7871.47 or later on Linux, per the Google Chrome Stable channel update at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html; restart the browser to ensure the new build is loaded, and in managed fleets push the update via your endpoint management or distro package channels since Chrome's silent auto-update alone may lag. If immediate patching is not possible, the practical compensating control is user-awareness guidance to avoid untrusted pages and unusual prompted UI gestures, since exploitation depends on user interaction; there is no documented feature toggle for Ozone to disable as a workaround, so patching is the definitive fix. Organizations can also constrain exposure by restricting browsing of untrusted sites via web proxy/URL filtering, accepting the trade-off of reduced user browsing freedom.