What is the CVSS score of CVE-2026-13891?

CVE-2026-13891 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by CVE-2026-13891?

Google Chrome Extensions prior to version 150.0.7871.47 contain a privilege escalation vulnerability that could allow attackers with prior renderer process access to elevate permissions on…. A patch is available.

How to fix or mitigate CVE-2026-13891?

Within 24 hours: inventory Chrome versions deployed across the organization and identify systems with recent renderer-level compromises or suspicious extension activity. Within 7 days: deploy Chrome 150.0.7871.47 or later via standard patch management, prioritizing user-facing systems with high-risk profiles or access to sensitive data. Within 30 days: verify patch compliance across all Chrome deployments and audit extension manifests for suspicious permissions.

Google Chrome CVE-2026-13891

EUVD-2026-40577 HIGH

Improper Input Validation (CWE-20)

2026-06-30 chrome-cve-admin@google.com

GHSA-86ph-mmh8-99jx

Privilege Escalation Google Red Hat Suse

7.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Kept AV:N/AC:H/UI:R per Chromium scoring convention; PR:N reflects web-content origin though a renderer foothold is required, and sandbox escape yields full C/I/A impact within an unchanged scope.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

8.7 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 14:27 vuln.today

CVSS changed

Jul 01, 2026 - 14:22 NVD

7.5 (HIGH)

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

HIGH 7.5

DescriptionCVE.org

Insufficient validation of untrusted input in Extensions in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to perform privilege escalation via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Privilege escalation in Google Chrome's Extensions component (versions prior to 150.0.7871.47) lets a remote attacker who has already compromised the renderer process break out via a crafted HTML page. Rated Medium by Chromium and CVSS 7.5, it stems from insufficient validation of untrusted input (CWE-20) and requires user interaction plus a pre-existing renderer foothold. There is no public exploit identified at time of analysis, EPSS is low (0.22%, 12th percentile), and it is not on CISA KEV.

Technical ContextAI

The flaw lives in Chrome's Extensions subsystem, the browser layer that mediates privileged APIs exposed to extensions and to web content interacting with them. The root cause is CWE-20 (Improper Input Validation): the Extensions code accepts untrusted input - originating from an already-compromised renderer process - without adequate validation, allowing an attacker to cross the privilege boundary between the sandboxed renderer and the higher-privileged browser context. Because Chromium renderers are sandboxed by design, this class of bug is typically chained as the second stage of a sandbox escape rather than an initial entry point. The affected code is Chromium's cross-platform Extensions implementation shipped in the desktop Stable channel (Chrome, and by extension Chromium-based browsers consuming the same engine).

RemediationAI

Vendor-released patch: 150.0.7871.47. Update Google Chrome to 150.0.7871.47 or later via the Stable desktop channel and confirm by navigating to chrome://settings/help, which forces an update check and relaunch. In managed environments, ensure auto-update is enabled or push the fixed build through your enterprise update/MDM channel, and reduce exposure to the renderer-compromise precondition by keeping the browser current and restricting installation of untrusted extensions. There is no vendor-published standalone workaround; because exploitation depends on first compromising the renderer, keeping all Chrome components patched (which closes the renderer bugs used as the first stage) is the effective compensating control, at the trade-off of relying on timely update rollout. See Google's advisory: https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html and the Chromium issue https://issues.chromium.org/issues/501631475.