What is the CVSS score of CVE-2026-13893?

CVE-2026-13893 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-13893?

Yes, a patch is available for CVE-2026-13893. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-13893

EUVD-2026-40579 MEDIUM

Improper Input Validation (CWE-20)

2026-06-30 chrome-cve-admin@google.com

GHSA-x5fc-38m7-rp7v

Information Disclosure Google Red Hat Suse

6.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network-delivered with no attacker privileges needed but active user interaction required; impact is confidentiality-only with no scope change, consistent with cross-origin data leak.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

6.5 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 15:41 vuln.today

CVSS changed

Jul 01, 2026 - 15:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 6.5

DescriptionCVE.org

Insufficient validation of untrusted input in WebUI in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via malicious network traffic. (Chromium security severity: Medium)

AnalysisAI

Cross-origin data exfiltration in Google Chrome's WebUI component (versions prior to 150.0.7871.47) enables remote attackers to leak sensitive data across origin boundaries by delivering crafted malicious network traffic to an unpatched browser. The flaw arises from insufficient input validation (CWE-20) within the WebUI layer, undermining same-origin policy protections and exposing data from isolated origins to attacker-controlled contexts. No active exploitation is confirmed - the vulnerability is absent from CISA KEV, EPSS sits at 0.20% (10th percentile), and no public POC has been identified; a vendor-released patch is available in Chrome 150.0.7871.47.

Technical ContextAI

Google Chrome's WebUI framework renders the browser's internal privileged pages (settings, new tab, extensions, etc.) using web technologies within a sandboxed environment that interacts with native browser internals. CWE-20 (Improper Input Validation) identifies the root cause: externally supplied network data processed by the WebUI subsystem is not sufficiently sanitized before use, allowing an attacker to influence how WebUI handles cross-origin context boundaries. This class of flaw can permit one origin's data to be read by a script or process controlled by another origin, bypassing the browser's fundamental same-origin isolation model. Affected CPE inferred from EUVD EUVD-2026-40579: Chrome versions below 150.0.7871.47 across all supported desktop platforms.

RemediationAI

The primary remediation is upgrading Google Chrome to version 150.0.7871.47 or later, which includes the vendor-released patch per the stable channel advisory at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome's built-in auto-update mechanism delivers this version automatically to most end users; enterprise administrators should validate rollout via Google Admin Console fleet management or GPO-based Chrome Browser Cloud Management policies. As a temporary compensating control before patching, restricting browser access to untrusted external sites via a web proxy or content filtering policy will reduce exposure - note this has significant operational impact for users requiring open browsing. Disabling or restricting WebUI-adjacent features in managed Chrome deployments is not a documented workaround and should not be relied upon. No patch side effects have been reported by the vendor.