What is the CVSS score of CVE-2026-13888?

CVE-2026-13888 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Google Chrome are affected by CVE-2026-13888?

Google Chrome versions before 150.0.7871.47 contain a use-after-free vulnerability in the Extensions component allowing arbitrary code execution when users open malicious HTML pages.. A patch is available.

How to fix or mitigate CVE-2026-13888?

Within 24 hours: Audit Chrome deployment scope and current version distribution. Within 7 days: Deploy Google Chrome 150.0.7871.47 (Stable channel) organization-wide via your endpoint management system. Within 30 days: Validate 100% deployment completion and conduct compatibility testing on critical browser extensions.

Google Chrome CVE-2026-13888

EUVD-2026-40574 HIGH

Use After Free (CWE-416)

2026-06-30 chrome-cve-admin@google.com

GHSA-9qcf-4vgg-28rh

RCE Denial Of Service Google Use After Free Memory Corruption Red Hat Suse

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-delivered via crafted page needing only user interaction (UI:R, PR:N, AC:L); high renderer-process impact retained, though sandbox containment (S:U) means host compromise needs a further escape.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

8.8 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 14:27 vuln.today

CVSS changed

Jul 01, 2026 - 14:22 NVD

8.8 (HIGH)

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

HIGH 8.8

DescriptionCVE.org

Use after free in Extensions in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Use-after-free in the Extensions component of Google Chrome before 150.0.7871.47 lets a remote attacker execute arbitrary code within the renderer sandbox when a victim opens a crafted HTML page. Chromium rated the security severity Medium, though the associated CVSS score is 8.8 (High) due to network vector and high impact; there is no public exploit identified at time of analysis and EPSS exploitation probability is low at 0.26%. Google has shipped a fixed Stable channel build.

Technical ContextAI

The flaw is a CWE-416 use-after-free in Chrome's Extensions subsystem, part of the Chromium browser engine. Use-after-free occurs when code continues to reference heap memory that has already been freed, allowing an attacker who controls subsequent heap allocations to place attacker-influenced data at the dangling pointer's location and corrupt object state. In browser exploitation this is a classic primitive for hijacking control flow. The description explicitly scopes the resulting code execution to 'inside a sandbox,' meaning the corruption occurs in the sandboxed renderer/extension process rather than the privileged browser process, so a full system compromise would require chaining an additional sandbox-escape bug. No CPE strings were provided, but the EUVD affected-version data identifies desktop Chrome builds prior to 150.0.7871.47.

RemediationAI

Vendor-released patch: update Google Chrome to 150.0.7871.47 or later on the Stable channel, as announced in Google's release notes at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html; the bug is tracked at https://issues.chromium.org/issues/500566906. Most installations receive this automatically, so verify the running version under chrome://settings/help and relaunch to apply the update, and ensure managed fleets are not pinning an older build. If patching must be delayed, reduce exposure by restricting or disabling browser extensions via enterprise policy (ExtensionInstallBlocklist / ExtensionInstallAllowlist) since the flaw is in the Extensions component - trade-off: this can break workflows that depend on approved extensions. Users of Chromium-based browsers should update to a release that has rebased onto the patched Chromium version once their vendor ships it.