What is the CVSS score of CVE-2026-13859?

CVE-2026-13859 has a contested CVSS base score of 9.6 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-13859?

Google Chrome versions prior to 150.0.7871.47 contain a critical sandbox escape vulnerability affecting Windows, macOS, and Linux users, enabling attackers to bypass browser security isolation…. A patch is available.

How to fix or mitigate CVE-2026-13859?

Within 24 hours, audit current Chrome deployment versions across all Windows, macOS, and Linux systems to identify affected installations prior to 150.0.7871.47. Within 7 days, prioritize rollout of Chrome 150.0.7871.47 or later via your endpoint management system, targeting browsers on public-facing and high-risk user endpoints first; ensure deployment is mandatory and non-deferrable. Within 30 days, run a comprehensive audit to confirm patch deployment to 100% of Chrome instances and configure automatic updates to prevent future version drift, while monitoring enterprise logging for any anomalous web activity patterns that could indicate exploitation attempts.

Google Chrome CVE-2026-13859

EUVD-2026-40545 CRITICAL

Protection Mechanism Failure (CWE-693)

2026-06-30 chrome-cve-admin@google.com

GHSA-8wcv-x3w8-wxw2

Information Disclosure Google Red Hat

Critical

Disputed · 9.6 Vendor: google

Severity by source

Sources disagree (Medium–Critical)

Vendor (google) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

Remote crafted page with no auth (AV:N/PR:N/UI:R) escaping the sandbox is a scope change (S:C) with high impact, but 'potentially' plus SSVC Automatable:no and needing a chained bug justify AC:H over AC:L.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

9.6 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 19:56 vuln.today

CVE Published

Jun 30, 2026 - 23:17 cve.org

CRITICAL 9.6

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Sandbox escape in Google Chrome's ANGLE graphics component (versions prior to 150.0.7871.47) allows a remote attacker who lures a victim to a crafted HTML page to potentially break out of the renderer sandbox, a critical trust-boundary bypass affecting the Windows/macOS/Linux desktop browser. The NVD scores this 9.6 (scope-changed) though Google rates the underlying Chromium issue as Medium severity, and there is no public exploit identified at time of analysis. EPSS is low (0.21%) and CISA SSVC records exploitation status as none, indicating no observed active abuse.

Technical ContextAI

ANGLE (Almost Native Graphics Layer Engine) is Chrome's translation layer that maps WebGL/OpenGL ES calls onto the host platform's native graphics API (Direct3D on Windows, Metal on macOS, Vulkan/OpenGL on Linux). Because ANGLE processes attacker-influenced GPU commands and historically runs with more privilege than the renderer, a flaw here can undermine the sandbox that isolates web content. The CWE-693 (Protection Mechanism Failure) classification indicates the root cause is an 'inappropriate implementation' of a security control rather than a classic memory-corruption primitive - the defensive boundary itself is bypassed rather than a buffer being overrun. The single affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*.

RemediationAI

Vendor-released patch: Google Chrome 150.0.7871.47 - upgrade to this version or later via Chrome's built-in updater (chrome://settings/help) and relaunch to apply, which is the primary and only complete fix. Enterprises managing Chrome via policy should promote the updated Stable build through their deployment tooling and confirm auto-update is enabled rather than pinned to an older milestone. Users of Chromium-based browsers should apply their vendor's next update that rebases onto Chromium 150.0.7871.47 or later. As an interim compensating control until patching, sandbox-escape exposure can be reduced by ensuring Chrome's built-in sandbox is not disabled (never run with --no-sandbox) and by restricting exposure to untrusted web content, but there is no supported feature toggle that disables ANGLE without breaking WebGL/GPU-accelerated content, so patching is strongly preferred. Reference the advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html.