What is the CVSS score of CVE-2026-13883?

CVE-2026-13883 has a contested CVSS base score of 9.6 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-13883?

Google Chrome versions prior to 150.0.7871.47 contain a sandbox escape vulnerability (CVE-2026-13883) that could allow remote attackers to execute code when users visit malicious websites,…. A patch is available.

How to fix or mitigate CVE-2026-13883?

Within 24 hours, send notification to all Chrome users and IT staff about the availability of Chrome 150.0.7871.47 or later and enable auto-update channels. Within 7 days, deploy Chrome 150.0.7871.47 or later to all managed endpoints via browser management tools (Chrome Enterprise Policy, Intune, Jamf, or equivalent); track deployment compliance through built-in reporting. Within 30 days, ensure all non-managed systems have been updated by sending reminder communications and validating that no systems remain on vulnerable versions prior to 150.0.7871.47; document final compliance metrics.

Google Chrome CVE-2026-13883

EUVD-2026-40569 CRITICAL

Access of Resource Using Incompatible Type (Type Confusion) (CWE-843)

2026-06-30 chrome-cve-admin@google.com

GHSA-2v7j-wfpj-jg3j

Information Disclosure Google Memory Corruption Red Hat

Critical

Disputed · 9.6 Vendor: google

Severity by source

Sources disagree (Medium–Critical)

Vendor (google) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

Network-reachable via a crafted page (AV:N) but type-confusion exploitation into a sandbox escape is complex and only 'potential' (AC:H); victim must load the page (UI:R) and the escape crosses the sandbox boundary (S:C).

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

9.6 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 19:54 vuln.today

CVE Published

Jun 30, 2026 - 23:17 cve.org

CRITICAL 9.6

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Type Confusion in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Sandbox escape in Google Chrome's ANGLE graphics layer (versions prior to 150.0.7871.47) allows a remote attacker to potentially break out of the renderer sandbox when a victim loads a crafted HTML page. The flaw is a CWE-843 type confusion; while NVD scores it CVSS 9.6 (critical), Google's own Chromium team rated the security severity as Medium, and there is no public exploit identified at time of analysis. EPSS is low (0.23%, 13th percentile) and CISA SSVC records no known exploitation, so this is a patch-on-cycle browser bug rather than an emergency.

Technical ContextAI

ANGLE (Almost Native Graphics Layer Engine) is Chrome's cross-platform graphics abstraction that translates WebGL/OpenGL ES calls onto native backends (Direct3D on Windows, Metal on macOS, Vulkan/GL on Linux). Because ANGLE processes attacker-influenced GPU commands, it is a recurring source of renderer memory-safety issues. The root cause here is CWE-843 (Type Confusion): code interprets a memory object as an incompatible type, letting an attacker manipulate pointers or object layouts to corrupt memory. In Chrome this class of bug is significant because ANGLE work partly straddles the sandbox boundary, so successful exploitation can move an attacker from the constrained renderer toward the more privileged GPU/host process - a sandbox escape. The single CPE, cpe:2.3:a:google:chrome, confirms the affected surface is the Chrome desktop browser itself.

RemediationAI

Update Google Chrome to 150.0.7871.47 or later (Vendor-released patch: 150.0.7871.47), then relaunch the browser so the new binary is loaded - most environments should trigger Chrome's built-in auto-update or push it via enterprise policy/MDM. Users of Chromium-based or vendor-repackaged builds (e.g. SUSE-distributed packages) should apply the corresponding distribution update once it incorporates the fixed ANGLE revision. If patching must be deferred, the practical compensating control is to reduce attack surface by disabling hardware-accelerated GPU/WebGL exposure - for example enforcing the enterprise policy to disable 3D APIs / hardware acceleration (chrome://settings 'Use graphics acceleration' off, or the HardwareAccelerationModeEnabled policy) so ANGLE processes less attacker-controlled graphics content; the trade-off is degraded rendering performance for WebGL and video-heavy sites. Reference advisory: https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html.