What is the CVSS score of CVE-2026-13899?

CVE-2026-13899 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Google Chrome are affected by CVE-2026-13899?

Google Chrome versions prior to 150.0.7871.47 contain a high-severity remote code execution vulnerability affecting your organization's users and systems; no public exploit has been identified to…. A patch is available.

How to fix or mitigate CVE-2026-13899?

Within 24 hours, audit your organization's Chrome deployment scope-including managed desktop, mobile, and unmanaged devices-to assess patch deployment capacity and prioritize user populations. Within 7 days, deploy Chrome version 150.0.7871.47 or later across all systems via your standard patch management process, prioritizing critical user groups and systems handling sensitive data. Within 30 days, verify complete deployment through compliance scanning and audit patch success metrics to confirm closure of this vulnerability across the organization.

Google Chrome CVE-2026-13899

EUVD-2026-40585 HIGH

Use After Free (CWE-416)

2026-06-30 chrome-cve-admin@google.com

GHSA-qww2-8xrr-mm79

RCE Denial Of Service Google Use After Free Memory Corruption Red Hat

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Remote crafted page with no auth but required victim interaction (UI:R); execution stays in the sandbox so scope is unchanged (S:U) with high renderer-level CIA impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

6.3 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 19:52 vuln.today

CVE Published

Jun 30, 2026 - 23:17 cve.org

HIGH 8.8

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Use after free in HTML in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Remote code execution in Google Chrome prior to 150.0.7871.47 stems from a use-after-free (CWE-416) in the browser's HTML handling, letting a remote attacker who lures a victim to a crafted page execute arbitrary code, though execution is confined inside Chrome's renderer sandbox. Chromium rated the issue Medium severity precisely because the code runs within the sandbox rather than escaping it; no public exploit identified at time of analysis, and EPSS is low at 0.27% (18th percentile) with SSVC exploitation status 'none'. Google has shipped a fixed Stable-channel build.

Technical ContextAI

The flaw is a use-after-free (CWE-416) in Chrome's HTML processing path, part of the Blink rendering engine that parses and renders HTML/DOM content. Use-after-free bugs occur when a pointer to freed heap memory is dereferenced or reused, allowing an attacker who controls heap layout to place attacker-influenced data where the freed object was, leading to memory corruption and, when weaponized, control-flow hijacking. The affected component is the Chromium renderer process, which is isolated in an OS-level sandbox; per the description the resulting arbitrary code execution occurs 'inside a sandbox,' meaning it grants control of the renderer process but not, by itself, the host operating system. The CPE cpe:2.3:a:google:chrome covers the desktop browser across platforms.

RemediationAI

Vendor-released patch: update Google Chrome to 150.0.7871.47 or later via the Stable channel, per the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html; relaunch the browser to apply the update since Chrome staging alone does not complete the fix. In managed environments, push the update through enterprise policy or your patch-management tooling and verify chrome://settings/help shows the fixed build. Users of Chromium-based browsers should apply their vendor's corresponding update once it merges the upstream fix. As an interim compensating control before patching, ensure the site-isolation and renderer sandbox remain enabled (do not launch with --no-sandbox), and consider restricting exposure to untrusted web content; note this does not remove the vulnerability and only limits blast radius. Bug tracker: https://issues.chromium.org/issues/502109002.