What is the CVSS score of CVE-2026-13882?

CVE-2026-13882 has a contested CVSS base score of 9.6 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-13882?

Google Chrome versions prior to 150.0.7871.47 contain a vulnerability that could allow an attacker to escalate a compromised browser process to system-level access.. A patch is available.

How to fix or mitigate CVE-2026-13882?

Within 24 hours, notify all Chrome desktop users and IT administrators of the patch availability. Within 7 days, deploy Chrome 150.0.7871.47 or later to all enterprise endpoints using your standard update mechanism. Within 30 days, verify deployment completion and confirm automatic update policies are enabled to prevent future exposure.

Google Chrome CVE-2026-13882

EUVD-2026-40568 CRITICAL

Race Condition (CWE-362)

2026-06-30 chrome-cve-admin@google.com

GHSA-358r-mhj4-mm95

Information Disclosure Google Race Condition Red Hat

Critical

Disputed · 9.6 Vendor: google

Severity by source

Sources disagree (Medium–Critical)

Vendor (google) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

AV:N and UI:R match a crafted page, but AC:H reflects the probabilistic race and the real prerequisite of a pre-compromised renderer; S:C with C/I/A:H captures the full sandbox escape into the browser process.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

5.7 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 19:54 vuln.today

CVE Published

Jun 30, 2026 - 23:17 cve.org

CRITICAL 9.6

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Race in USB in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Sandbox escape in Google Chrome desktop prior to 150.0.7871.47 lets an attacker who has already compromised the renderer process break out of the sandbox by winning a race condition in the USB subsystem via a crafted HTML page. Chromium rated it Medium severity despite the 9.6 CVSS, reflecting that it is a second-stage bug requiring prior renderer compromise; there is no public exploit identified at time of analysis and it is not in CISA KEV, with EPSS at just 0.21% (11th percentile).

Technical ContextAI

The flaw is a CWE-362 race condition (concurrent execution using shared resource with improper synchronization) inside Chromium's USB (WebUSB/device) implementation, which straddles the boundary between the sandboxed renderer and the more-privileged browser process. Chrome's multi-process security model confines web content to a locked-down renderer; the USB broker code in the browser process handles privileged device operations. A time-of-check/time-of-use style race in this inter-process pathway can be manipulated so that a compromised renderer corrupts state in the browser process, undermining the sandbox boundary. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* confirms the affected product is the Chrome application across versions below the fix.

RemediationAI

Vendor-released patch: update Google Chrome to 150.0.7871.47 or later on all desktop platforms; Chrome typically auto-updates, so ensure the browser has been fully relaunched to apply the update and confirm the version under chrome://settings/help. Reference the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Because exploitation requires a compromised renderer plus WebUSB interaction, interim compensating controls include disabling WebUSB via enterprise policy (the DefaultWebUsbGuardSetting / WebUsbBlockedForUrls group policies) to remove the vulnerable device pathway - trade-off: this breaks legitimate web-based USB device workflows - and enforcing prompt update deployment via managed Chrome policy. Users of Chromium-based browsers should apply the equivalent update from their respective vendors.