What is the CVSS score of CVE-2026-13881?

CVE-2026-13881 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-13881?

Yes, a patch is available for CVE-2026-13881. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-13881

EUVD-2026-40567 MEDIUM

Origin Validation Error (CWE-346)

2026-06-30 chrome-cve-admin@google.com

GHSA-x3mf-c66j-h6vv

Authentication Bypass Google Red Hat Suse

6.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

vuln.today AI

6.5 MEDIUM

Network-delivered via crafted page (AV:N, PR:N); user must visit it (UI:R); SOP bypass yields cross-origin integrity impact (I:H) with no confirmed data exfiltration (C:N) or availability effect.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

9.3 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 16:29 vuln.today

CVSS changed

Jul 01, 2026 - 16:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 6.5

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in WebAppInstalls in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Same-origin policy bypass in Google Chrome's WebAppInstalls component allows remote attackers to compromise cross-origin integrity via a crafted HTML page, affecting all Chrome versions prior to 150.0.7871.47. The flaw stems from an inappropriate implementation (CWE-346, Origin Validation Error) in the PWA installation subsystem, enabling an attacker to perform unauthorized cross-origin writes or manipulations when a user visits attacker-controlled content. No public exploit identified at time of analysis, and the EPSS score of 0.23% (14th percentile) indicates low near-term exploitation probability, though the ubiquitous deployment of Chrome elevates aggregate exposure.

Technical ContextAI

CWE-346 (Origin Validation Error) describes a failure to properly verify that a request or resource originates from the expected, trusted origin - the foundational mechanism of the Same-Origin Policy (SOP). The affected component, WebAppInstalls, manages the installation and manifest processing of Progressive Web Apps (PWAs) within the Chromium engine. When a browser incorrectly validates the origin during web app installation flows, an attacker's crafted HTML page can trigger cross-origin actions that the SOP is specifically designed to prevent. Affected product is Google Chrome prior to version 150.0.7871.47 across desktop platforms (CPE inferred from EUVD affected version range: Chrome < 150.0.7871.47). The Chromium project internally tracks this as issue 499100491.

RemediationAI

Vendor-released patch: Chrome 150.0.7871.47. Users and administrators should update to Chrome 150.0.7871.47 or later immediately using Chrome's built-in update mechanism (Settings → Help → About Google Chrome) or enterprise deployment tools. The advisory is available at chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. For enterprise environments where immediate patching is not feasible, restricting access to untrusted external web content via content filtering proxies or disabling PWA installation via Group Policy (ChromeWebAppInstallForceList / WebAppSettings) reduces attack surface, though this affects legitimate PWA functionality. No other confirmed workaround is identified in the available data.