What is the CVSS score of CVE-2026-13906?

CVE-2026-13906 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Is there a patch available for CVE-2026-13906?

Yes, a patch is available for CVE-2026-13906. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-13906

EUVD-2026-40592 MEDIUM

Out-of-bounds Read (CWE-125)

2026-06-30 chrome-cve-admin@google.com

GHSA-3jm2-rcq7-256m

Buffer Overflow Information Disclosure Google Red Hat Suse

6.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network-delivered via crafted page requiring user visit (UI:R, PR:N); memory disclosure only with no write or availability impact; sandbox boundary enforces S:U.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

6.5 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 02:26 vuln.today

CVSS changed

Jul 01, 2026 - 02:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 6.5

DescriptionCVE.org

Out of bounds read in Codecs in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Out-of-bounds read in Google Chrome's Codecs component (prior to 150.0.7871.47) enables remote attackers to leak sensitive data from renderer process memory by delivering a crafted HTML page. The CVSS C:H rating reflects meaningful exposure of in-process data such as session tokens or credentials, though Chromium's own team assessed this as Medium severity, and the sandbox boundary (S:U) limits blast radius to the renderer. No public exploit code and no CISA KEV listing have been identified at time of analysis.

Technical ContextAI

The vulnerability resides in Chrome's Codecs subsystem - the component responsible for decoding audio and video media streams embedded in or referenced by HTML pages. CWE-125 (Out-of-Bounds Read) indicates that during parsing of malformed media bitstream or container data, insufficient bounds validation causes the decoder to read memory beyond its allocated buffer, exposing adjacent process memory contents. The CVSS vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N confirms network delivery with low attack complexity, no privilege requirement, but mandatory user interaction. Scope is Unchanged, meaning exploitation is constrained to the Chrome renderer sandbox rather than the underlying OS. All desktop Chrome versions prior to 150.0.7871.47 on Windows, macOS, and Linux are affected per EUVD-2026-40592.

RemediationAI

Update Google Chrome to version 150.0.7871.47 or later using the stable channel update documented at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome's auto-update mechanism will deploy this for most users, but enterprise administrators should verify compliance across managed endpoints using fleet management tools. Where immediate patching is not feasible, restrict user access to untrusted or external web content through a web proxy allowlist - note this impairs general browsing. Disabling media playback in Chrome via enterprise policy (AudioCaptureAllowed, VideoCaptureAllowed) may reduce attack surface but breaks legitimate media functionality. No workaround fully mitigates the flaw without patching.