What is the CVSS score of CVE-2026-13897?

CVE-2026-13897 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google are affected by CVE-2026-13897?

Google Chrome desktop users organization-wide are exposed to a privilege escalation vulnerability (CVE-2026-13897, CVSS 8.8) in versions prior to 150.0.7871.47, which could allow attackers to…. A patch is available.

How to fix or mitigate CVE-2026-13897?

Within 24 hours, assess your organization's Chrome deployment scale and identify systems that handle sensitive data or administrative functions, as privilege escalation on these assets poses the highest risk. Within 7 days, deploy Google Chrome version 150.0.7871.47 or later through your patch management system, prioritizing endpoints with elevated privileges or production access. Within 30 days, verify patch deployment across all Chrome installations, audit systems for any exploitation artifacts in browser logs, and update your vulnerability inventory to confirm full remediation.

Google CVE-2026-13897

EUVD-2026-40583 HIGH

Improper Access Control (CWE-284)

2026-06-30 chrome-cve-admin@google.com

GHSA-r2vp-m7vr-jfp6

Authentication Bypass Privilege Escalation Google Red Hat

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

6.5 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 19:53 vuln.today

CVE Published

Jun 30, 2026 - 23:17 cve.org

HIGH 8.8

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient policy enforcement in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform privilege escalation via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Privilege escalation in Google Chrome's Chromecast component affects all desktop versions prior to 150.0.7871.47, where insufficient policy enforcement lets a remote attacker who lures a victim to a crafted HTML page escalate privileges within the browser. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS is low at 0.21% (11th percentile). Note a signal conflict: the assigned CVSS is 8.8 (High) while Google/Chromium rated the underlying flaw only Medium severity.