What is the CVSS score of CVE-2026-13903?

CVE-2026-13903 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by CVE-2026-13903?

A privilege escalation vulnerability in Google Chrome (CVE-2026-13903, CVSS 8.8) enables attackers to bypass security controls and gain elevated system access when employees visit malicious websites,…. A patch is available.

How to fix or mitigate CVE-2026-13903?

Within 24 hours, assess Google Chrome version distribution across the organization to identify systems running versions before 150.0.7871.47. Within 7 days, deploy Chrome version 150.0.7871.47 or later to all enterprise desktops and laptops using your standard patch management process, prioritizing user-facing systems. Within 30 days, confirm full deployment compliance through endpoint monitoring, resolve any blockers or regressions, and document any systems that remain on older versions with business justification.

Google Chrome CVE-2026-13903

EUVD-2026-40589 HIGH

Client-Side Enforcement of Server-Side Security (CWE-602)

2026-06-30 chrome-cve-admin@google.com

GHSA-pv8j-6v7f-j6h8

Privilege Escalation Google Red Hat

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

5.4 MEDIUM

Network-delivered page requiring user interaction (UI:R), unauthenticated (PR:N); impact scored Low/Low to reflect Chromium's own Medium rating for a scoped Bluetooth policy bypass rather than NVD's full C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

9.6 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 19:52 vuln.today

CVE Published

Jun 30, 2026 - 23:17 cve.org

HIGH 8.8

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient policy enforcement in Bluetooth in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform privilege escalation via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Privilege escalation in Google Chrome desktop before 150.0.7871.47 stems from insufficient policy enforcement in the browser's Bluetooth stack, letting a remote attacker who lures a victim to a crafted HTML page bypass client-side security checks (CWE-602). Exploitation requires user interaction (visiting the page) but no authentication (PR:N/UI:R), and NVD scores it 8.8 while Google's own Chromium team rated the severity Medium. There is no public exploit identified at time of analysis, EPSS is low at 0.22%, and CISA SSVC records exploitation status as none.

Technical ContextAI

The flaw lives in Chrome's implementation of the Web Bluetooth API, which exposes Bluetooth GAP/GATT device access to web content under a permission and policy model enforced by the browser. CWE-602 (Client-Side Enforcement of Server-Side Security) indicates that a security decision that should be authoritatively enforced was instead performed in a bypassable client-side context, so a crafted page can subvert the intended Bluetooth policy/permission gating and reach capabilities it should not have. The affected component is the Chromium browser engine (cpe:2.3:a:google:chrome), meaning every Chromium-derived channel shipping this Bluetooth code before the fixed build is potentially in scope, though only the Google Chrome CPE is explicitly enumerated here.

RemediationAI

Vendor-released patch: update Google Chrome to 150.0.7871.47 or later on all desktop platforms via the Chrome Stable channel; most installs will receive this automatically, so verify auto-update is enabled and force a relaunch (chrome://settings/help) to apply immediately. For managed fleets, push the fixed build through your enterprise update tooling (Google Update/ADMX policies) and confirm SUSE/Chromium repackages are updated to the corresponding patched version. If patching cannot be completed immediately, a targeted compensating control is to disable Web Bluetooth via the DefaultWebBluetoothGuardSetting enterprise policy (set to block), which prevents pages from accessing the Bluetooth API - the trade-off is that any legitimate internal web apps relying on Web Bluetooth will break. Reference: https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html.