What is the CVSS score of CVE-2026-13863?

CVE-2026-13863 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-13863?

A privilege escalation vulnerability in Google Chrome for Android's CustomTabs feature (CVE-2026-13863) could enable attackers to gain elevated system permissions on affected devices.. A patch is available.

How to fix or mitigate CVE-2026-13863?

Within 24 hours: Audit current Chrome for Android versions across managed devices and BYOD inventory. Within 7 days: Deploy Chrome for Android 150.0.7871.47 or later via mobile device management (MDM); notify users of unmanaged devices to update via Google Play. Within 30 days: Verify patch deployment completion; review device logs for exploitation indicators.

Google Chrome CVE-2026-13863

EUVD-2026-40549 HIGH

Improper Input Validation (CWE-20)

2026-06-30 chrome-cve-admin@google.com

GHSA-j37g-2qp6-q3pv

Privilege Escalation Google Red Hat Suse

7.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local malicious file requiring user interaction with no prior privileges (AV:L/PR:N/UI:R); privilege escalation yields high C/I/A within the unchanged browser scope.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

6.6 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 15:26 vuln.today

CVSS changed

Jul 01, 2026 - 15:22 NVD

7.8 (HIGH)

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

HIGH 7.8

DescriptionCVE.org

Insufficient validation of untrusted input in CustomTabs in Google Chrome on Android prior to 150.0.7871.47 allowed a local attacker to perform privilege escalation via a malicious file. (Chromium security severity: Medium)

AnalysisAI

Privilege escalation in Google Chrome for Android (CustomTabs) prior to 150.0.7871.47 allows a local attacker to escalate privileges by supplying a malicious file that CustomTabs fails to validate properly. Google rates the Chromium severity as Medium, and the requirement for user interaction plus local access limits remote mass exploitation. No public exploit has been identified at time of analysis and the EPSS score is very low (0.13%, 3rd percentile), so opportunistic exploitation appears unlikely.

Technical ContextAI

The flaw resides in Chrome's Android CustomTabs component, a framework that lets native Android apps embed a customized Chrome browser tab (a lightweight in-app browser) rather than launching the full browser or a WebView. The root cause is CWE-20 (Improper Input Validation): CustomTabs insufficiently validates untrusted input associated with a file, permitting a locally-present malicious file or a colluding/malicious app on the device to influence Chrome's behavior in a way that crosses a privilege boundary. Because CustomTabs is invoked via inter-app intents on Android, the untrusted input is plausibly delivered by another installed application handing Chrome a crafted file reference.

RemediationAI

Vendor-released patch: update Google Chrome for Android to version 150.0.7871.47 or later, delivered through the Chrome Releases stable channel (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html); on Android this arrives via Google Play, so ensure automatic app updates are enabled or manually update Chrome from the Play Store. There is no dedicated feature-disable workaround for CustomTabs, but as compensating controls until the update lands you can avoid opening files or links from untrusted apps in Chrome CustomTabs, restrict installation of untrusted third-party applications (the realistic delivery vector on Android), and use managed-device (MDM) policies to enforce timely Chrome updates. Note the trade-off that blocking untrusted app installs reduces attack surface broadly but does not specifically neutralize a malicious file already present on the device.